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1.  INTRODUCTION 

One  of  the  most  important  notions  in  probability  theory  is  that  of  expectation. 
The  expected  value  of  a  random  variable  is,  in  a  sense,  the  single  number  that 
best  describes  the  random  variable.  While  probability  is  certainly  still  the  most 
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dominant  approach  to  representing  uncertainty,  in  the  past  two  decades  there 
has  been  a  great  deal  of  interest  in  alternative  representations  of  uncertainty, 
both  from  a  normative  and  descriptive  point  of  view.  This  may  seem  somewhat 
surprising  to  those  familiar  with  the  many  arguments  that  have  been  made  showing 
that  probability  is  the  only  rational  approach  to  representing  uncertainty  (see,  for 
example,  Cox  [1946],  Ramsey  [1931],  de  Finetti  [1931],  Savage  [1954]).  However,  all 
these  arguments  depend  on  assumptions,  perhaps  the  most  controversial  of  which 
is  that  the  uncertainty  of  an  event  can  be  completely  characterized  by  a  single 
number.  (See  Walley  [1991]  for  a  good  summary  of  the  arguments  for  the  need  to 
occasionally  go  beyond  probabilistic  expectation.)  Some  alternatives  to  probability 
in  the  literature  include  sets  of  probability  measure  [Huber  1981;  Walley  1991], 
Dempster- Shafer  belief  functions  [Shafer  1976]  and  the  closely  related  nonadditive 
measures  [Schmeidler  1989],  and  possibility  measures  [Dubois  and  Prade  1990]. 

In  this  paper,  we  consider  the  notion  of  expectation  for  all  these  representations 
of  uncertainty.  We  do  not  take  a  stand  here  on  what  the  “right”  way  is  to  represent 
uncertainty;  we  simply  investigate  characterizations  of  expectation  and  reasoning 
about  expectation,  both  for  probability  and  for  other  representations  of  uncertainty. 

It  is  well  known  that  a  probability  measure  determines  a  unique  expectation 
function  that  is  linear  (i.e. ,  E{aX  +  bY)  =  aE(X)  +  bE(Y)),  monotone  (i.e.,  X  <  Y 
implies  E(X)  <  E(Y)),  and  maps  constant  functions  to  their  value.  Conversely, 
given  an  expectation  function  E  (that  is,  a  function  from  random  variables  to  the 
reals)  that  is  linear,  monotone,  and  maps  constant  functions  to  their  value,  there 
is  a  unique  probability  measure  /i  such  that  E  =  E M.  That  is,  there  is  a  1-1 
mapping  from  probability  measures  to  (probabilistic)  expectation  functions.  One 
of  the  goals  of  this  paper  is  to  provide  similar  characterizations  of  expectation  for 
other  representations  of  uncertainty. 

Some  work  along  these  lines  has  already  been  done,  particulary  with  regard  to 
sets  of  probability  measures  [Huber  1981;  Walley  1991;  1981]. 1  However,  there 
seems  to  be  surprisingly  little  work  on  characterizing  expectation  in  the  context  of 
other  measures  of  uncertainty,  such  as  belief  functions  [Shafer  1976]  and  possibility 
measures  [Dubois  and  Prade  1990].  We  provide  characterizations  here. 

Having  characterized  expectation  functions,  we  then  turn  to  the  problem  of 
reasoning  about  them.  We  define  a  logic  similar  in  spirit  to  that  introduced  by 
Fagin  et  al.  [1990]  (FHM  from  now  on)  for  reasoning  about  likelihood  expressed 
as  either  probability  or  belief.  The  same  logic  is  used  by  Halpern  and  Pucella 
[2002a]  (HP  from  now  on)  for  reasoning  about  upper  probabilities.  The  logic  for 
reasoning  about  expectation  is  strictly  more  expressive  than  its  counterpart  for 
reasoning  about  likelihood  if  the  underlying  semantics  is  given  in  terms  of  sets 
of  probability  measures  (so  that  upper  probabilities  and  upper  expectations  are 
used,  respectively);  it  turns  out  to  be  equi-expressive  in  the  case  of  probability, 
belief  functions,  and  possibility  measures.  This  is  somewhat  surprising,  especially 
in  the  case  of  belief  functions.  In  all  cases,  the  fact  that  expectations  are  at  least  as 
expressive  is  immediate,  since  the  expectation  of  <p  (viewed  as  an  indicator  function, 
that  is,  the  random  variable  that  is  1  in  worlds  where  ip  is  true  and  0  otherwise) 


1  Walley  [1991]  actually  characterizes  lower  and  upper  previsions',  but  these  are  essentially  lower 
and  upper  expectations  with  respect  to  sets  of  probability  measures. 
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is  equal  to  its  likelihood.  However,  it  is  not  always  obvious  how  to  express  the 
expectation  of  a  random  variable  in  terms  of  likelihood. 

We  then  provide  a  sound  and  complete  axiomatization  for  the  logic  with  respect 
to  each  of  the  interpretations  of  expectation  that  we  consider,  using  our  characteri¬ 
zation  of  expectation.  Finally,  we  show  that,  just  as  in  the  case  of  the  corresponding 
logic  for  reasoning  about  likelihood,  the  complexity  of  the  satisfiability  problem  is 
NP-complete.  This  is  clear  when  the  underlying  semantics  is  given  in  terms  of 
probability  measures,  belief  functions,  or  possibility  measures,  but  it  is  perhaps 
surprising  that,  despite  the  added  expressiveness  in  the  case  of  sets  of  probability 
measures,  reasoning  in  the  logic  remains  NP-complete. 

To  the  best  of  our  knowledge,  there  is  only  one  previous  attempt  to  express 
properties  of  expectation  in  a  logical  setting.  Wilson  and  Moral  [1994]  take  as  their 
starting  point  Walley’s  notion  of  lower  and  upper  previsions.  They  consider  when 
acceptance  of  one  set  of  gambles  implies  acceptance  of  another  gamble.  This  is 
a  notion  that  is  easily  expressible  in  our  logic  when  the  original  set  of  gambles  is 
finite,  so  our  logic  subsumes  theirs  in  the  finite  case. 

This  paper  is  organized  as  follows.  In  the  next  section,  the  characterizations  of 
expectation  for  probability  measures  and  sets  of  probability  measures  are  reviewed, 
and  the  characterizations  of  expectation  for  belief  functions  and  possibility  measures 
are  provided.  In  Section  3,  we  introduce  a  logic  for  reasoning  about  expectation 
with  respect  to  all  these  representations  of  uncertainty.  In  Section  4,  we  compare 
the  expressive  power  of  our  expectation  logic  to  that  of  the  logic  for  reasoning 
about  likelihood.  In  Section  5,  we  derive  sound  and  complete  axiomatizations  for 
the  logic  in  Section  3,  with  respect  to  different  representations  of  uncertainty.  In 
Section  6,  we  prove  that  the  decision  problem  for  the  expectation  logic  is  NP- 
complete  for  each  of  the  representations  of  uncertainty  we  consider.  Finally,  in 
Section  7,  we  discuss  an  axiomatization  of  gamble  inequalities,  which  is  assumed 
by  the  axiomatizations  given  in  Section  5.  The  proofs  of  the  more  technical  results 
are  given  in  the  appendix. 


2.  EXPECTATION  FUNCTIONS 

Recall  that  a  random  variable  X  on  a  sample  space  (set  of  possible  worlds)  W  is 
a  function  from  W  to  some  range.  Let  V(X)  denote  the  image  of  X,  that  is,  the 
possible  values  of  X.  A  gamble  is  a  random  variable  whose  range  is  the  reals.  In 
this  paper,  we  focus  on  the  expectation  of  gambles.  Additionally,  we  restrict  to 
finite  sample  spaces;  most  of  the  issues  of  interest  already  arise  in  the  finite  sample 
space  setting.  (Most  of  the  results  in  this  section  extend  in  a  straightforward  way 
to  the  infinite  sample  space  setting,  by  adding  suitable  continuity  assumptions  on 
the  measures  defined.  See  Halpern  [2003]  for  more  detail.)  Note  that  if  the  sample 
space  is  finite,  the  range  V(X)  of  a  gamble  X  is  finite.  This  allows  us  to  define 
expectation  using  summation  rather  than  integration. 

2.1  Expectation  for  Probability  Measures 

Given  a  finite  sample  space  W ,  and  a  probability  measure  p  and  gamble  X  over 
W,  the  expected  value  of  X  (or  the  expectation  of  X)  with  respect  to  /x,  denoted 
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Ep(X),  is  just 

Y  »(w)X(w).  (1) 

w£W 

Thus,  the  expected  value  of  a  gamble  is  essentially  the  “average”  value  of  the 
variable. 

Actually,  (1)  makes  sense  only  if  every  singleton  is  measurable  (i.e.,  in  the  domain 
of  p) .  If  singletons  are  not  necessarily  measurable,  the  standard  assumption  is  that 
X  is  measurable  with  respect  to  the  algebra  T  on  which  p  is  defined;  that  is,  for  each 
value  x  £  V(X),  the  set  of  worlds  X  =  x  where  X  takes  on  value  x  is  measurable.2 
(In  general,  a  function  /  :  W  —>  W'  is  measurable  with  respect  to  T  if  f~1(w')  £  T 
for  all  w'  £  W' .)  Then 

E„{X)=  Y,  MX=x).  (2) 

x£V(X) 

Note  that  this  definition  makes  sense  even  if  W  is  not  finite,  so  long  as  V(A)  is 
finite.  It  is  easy  to  check  that  (1)  and  (2)  are  equivalent  if  W  is  finite  and  all 
singletons  are  measurable. 

As  is  well  known,  probabilistic  expectation  functions  can  be  characterized  by  a 
small  collection  of  properties.  If  X  and  Y  are  gambles  on  W  and  a  and  b  are  real 
numbers,  define  the  gamble  aX  +  bY  on  W  in  the  obvious  way:  (aX  +  bY)(w)  = 
aX(w )  +  bY(w).  Say  that  X  <  Y  if  X(w)  <  Y  (w)  for  all  w  £  W.  Let  c  denote  the 
constant  function  which  always  returns  c;  that  is,  c(w)  =  c.  Let  p  be  a  probability 
measure  on  W. 

Proposition  2.1.  The  function  has  the  following  properties  for  all  measur¬ 
able  gambles  X  and  Y. 

(a)  E„  is  additive:  E^X  +  Y)  =  E^X)  +  E^Y). 

(b)  E M  is  affinely  homogeneous:  E^(aX  +  b)  =  aE^(X)  +  b  for  all  a,b  G  R. 

(c)  E^  is  monotone:  if  X  <Y,  then  E^(X)  <  E^ifY). 

PROOF.  See  any  standard  text  in  probability  or  discrete  mathematics  [Billingsley 
1995]  □ 

The  next  result  shows  that  the  properties  in  Proposition  2.1  essentially  character¬ 
ize  probabilistic  expectation  functions.  It  too  is  well  known.  We  provide  the  proof 
here,  just  to  show  how  the  assumptions  are  used.  In  the  proof  (and  throughout 
the  paper)  we  make  use  of  a  special  type  of  random  variable.  Let  Xu  denote  the 
gamble  such  that  Xjj(w)  =  1  if  w  £  U  and  Xu{w)  =  0  if  w  ^  U.  A  gamble  of  the 
form  Xu  is  traditionally  called  an  indicator  function. 

Theorem  2.2.  Suppose  that  E  maps  gambles  measurable  with  respect  to  some 
algebra  tF  to  R  and  E  is  additive,  affinely  homogeneous,  and  monotone.  Then  there 
is  a  (necessarily  unique)  probability  measure  p  on  T  such  that  E  =  E 


2  Recall  that  an  algebra  T  over  a  sample  space  W  is  a  set  of  subsets  of  W  that  includes  W  itself 
and  is  closed  under  complementation  and  union,  so  that  if  U,  V  G  T ,  then  so  is  U  and  U  U  V . 
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Proof.  Define  n(U)  =  E(Xjj).  Note  that  Xw  =  1,  so  n(W)  =  1,  since  E  is 
affinely  homogeneous.  Since  X0  is  0  and  E  is  affinely  homogeneous,  it  follows  that 
/z(0)  =  E(X0)  =  0.  X0  <  Xjj  <  Xw  for  all  U  C  W;  since  E  is  monotone,  it 
follows  that  0  =  E(X0)  <  E(Xjj)  =  li(U)  <  E(Xw)  =  1.  If  U  and  V  are  disjoint, 
then  it  is  easy  to  see  that  Xuvv  =  Xu  +  Xv.  By  additivity, 

H(U  UV)  =  E(XUUV )  =  E{XV)  +  E(XV)  =  p(U)  +  p{V). 

Thus,  /i  is  indeed  a  probability  measure. 

To  see  that  E  =  E note  that  it  is  immediate  from  (2)  that  n(U)  =  E^(Xu)  for 
U  £  T .  Thus,  E ^  and  E  agree  on  all  measurable  indicator  functions.  Every  mea¬ 
surable  gamble  X  can  be  written  as  a  linear  combination  of  measurable  indicator 
functions.  For  each  a  €  V(X),  let  Ux,a  =  :  X(w)  =  a}.  Since  X  is  a  measurable 

gamble,  Ux.a  must  be  in  T .  Moreover,  X  =  'Yhaev(x)  aXux,a-  By  additivity  and 
affine  homogeneity,  E^X)  =  J]aev(  Y)  a^(Xux,a)-  By  Proposition  2.1,  E^(X)  = 
Saev(A')  aEn(Xux,a)-  Since  E  and  E M  agree  on  measurable  indicator  functions,  it 
follows  that  E(X)  =  Ep  (X).  Thus,  E  =  E^  as  desired. 

Clearly,  if  n(U)  ^  n'(U),  then  E^(Xu)  ^  E^(Xu)-  Thus,  /i  is  the  unique 
probability  measure  on  T  such  that  E  =  E^.  □ 

2.2  Expectation  for  Sets  of  Probability  Measures 

If  V  is  a  set  of  probability  measures  on  a  space  W,  define 

V*{U)  =  inf{/r(/7)  :  n  £  V}  and 
V*(U)=sup{n(U)  :  n  £  V}. 

V*(U)  is  called  the  lower  probability  of  U  and  V*(U)  is  called  the  upper  probability 
of  U .  Lower  and  upper  probabilities  have  been  well  studied  in  the  literature  (see, 
for  example,  Borel  [1943],  Smith  [1961]). 

There  are  straightforward  analogues  of  lower  and  upper  probability  in  the  context 
of  expectation.  If  V  is  a  set  of  probability  measures  such  that  X  is  measurable  with 
respect  to  each  probability  measure  /./  £  V ,  then  define  E-p(X)  =  {E^X)  :  p  £  V}. 
E-p(X)  is  a  set  of  numbers.  Define  the  lower  expectation  and  upper  expectation  of 
X  with  respect  to  V,  denoted  EV(X)  and  E-p(X),  as  the  inf  and  sup  of  the  set 
E-p(X ),  respectively. 

The  properties  of  E-p  and  Ep  are  not  so  different  from  those  of  probabilistic 
expectation  functions.  Note  that  Ep(Xu)  =  p(U).  Similarly,  it  is  easy  to  see 
that  V*{U)  =  Ep(Xu)  and  V*{U )  =  Ep{Xjj).  Moreover,  we  have  the  following 
analogue  of  Propositions  2.1. 

Proposition  2.3.  The  functions  Ep  and  Ep  have  the  following  properties  for 
all  gambles  X  and  Y. 

(a)  EV(X  +  Y)  >  Ep(X)  +  Ep(Y)  (superadditivity,); 

Ep(X  +  Y)  <  Ep(X)  +  Ep(Y)  (subadditivity,). 

(b)  Ep  and  Ep  are  both  positively  affinely  homogeneous:  Ev(aX+b )  =  aEv(X)  + 
b  and  Ep(aX  +  b)  =  aEp(X)  +  b  if  a,  b  £  R,  a  >  0. 

(c)  Ep  and  Ep  are  monotone. 

(d)  EV(X)  =  -Ep(-X). 
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PROOF.  This  result  is  also  well-known;  see  Walley  [1991,  Section  2.6.1].  (Walley 
proves  the  result  for  what  he  calls  coherent  lower  and  upper  previsions,  but  then 
proves  [Walley  1991,  Section  3.3.4]  that  these  are  equivalent  to  lower  and  upper 
expectations,  respectively.)  □ 

Superadditivity  (resp.,  subadditivity),  positive  affine  homogeneity,  and  mono¬ 
tonicity  in  fact  characterize  Ep  (resp.,  Ep). 

Theorem  2.4.  [Huber  1981]  Suppose  that  E  maps  gambles  measurable  with 
respect  to  T  to  K.  and  is  superadditive  (resp.,  subadditive) ,  positively  affinely  homo¬ 
geneous,  and  monotone.  Then  there  is  a  set  V  of  probability  measures  on  T  such 
that  E  =  Ep  (resp.,  E  =  Ep ).3 

The  set  V  constructed  in  Theorem  2.4  is  not  unique.  It  is  not  hard  to  construct 
sets  V  and  V  such  that  V  ^  V  but  Ev  =  Ev, .  However,  there  is  a  canonical  largest 
set  V  such  that  E  =  Ev\  V  consists  of  all  probability  measures  p  such  that  E^X)  > 
E(X)  for  all  gambles  X.  This  set  V  can  be  shown  to  be  closed  and  convex.  Indeed, 
it  easily  follows  that  Theorem  2.4  actually  provides  a  1-1  mapping  from  closed, 
convex  sets  of  probability  measures  to  lower/upper  expectations.  Moreover,  in  a 
precise  sense,  this  is  the  best  we  can  do.  If  V  and  V'  have  the  same  convex  closure 
(where  the  convex  closure  of  a  set  is  the  smallest  closed,  convex  set  containing  it), 
then  Ep  =  Ep,. 

As  Walley  [1991]  shows,  what  he  calls  coherent  lower/upper  previsions  are  also 
lower/upper  expectations  with  respect  to  some  set  of  probability  measures.  Thus, 
lower/upper  previsions  can  be  identified  with  closed,  convex  sets  of  probability 
measures. 

2.3  Expectation  for  Belief  Functions 

As  is  well  known,  a  belief  function  [Shafer  1976]  Bel  is  a  function  from  subsets  of  a 
state  space  W  to  [0, 1]  satisfying  the  following  three  properties: 

Bl.  Bel(0)  =  0. 

B2.  Bel(W)  =  1. 

B3.  For  n—  1,2,3,..., 

BeldJlLi  Ui)  >  E”=iE{/c{i,...,n}:|7|=d(-l)l+1Bel(aez^)- 

Given  a  belief  function  Bel,  there  is  a  corresponding  plausibility  function  Plaus, 
where  Plaus(ll)  =  1  —  Bel(f7).  It  follows  easily  from  B3  that  Bel(I/)  <  Plaus(17) 
for  all  U  C  W.  Bel(IZ)  can  be  thought  of  as  a  lower  bound  of  a  set  of  probabilities 
and  Plaus(t/)  can  be  thought  of  as  the  corresponding  upper  bound.  This  intuition 
is  made  precise  in  the  following  well-known  result. 

Theorem  2.5.  [Dempster  1967]  Given  a  belief  function  Bel  defined  on  W,  let 
VBei  =  {h  ■  h(U)  >  Bel([/)  for  all  U  C  W}.  Then  Bel  =  (TW)*-4 


3There  is  an  equivalent  characterization  of  Ep,  due  to  Walley  [1991].  He  shows  that  E  =  Ep 
for  some  set  V  of  probability  measures  iff  E  is  superadditive,  E(cX)  =  cE(X ),  and  E(X)  > 
inf{X(tc)  :  w  G  W}.  There  is  an  analogous  characterization  of  Ep. 

4Dempster  [1967]  defines  T^Bei  as  :  Plaus (C7)  >  l^(U)  >  Bel(t7)  for  all  U  C  W},  but  his 
definition  is  easily  seen  to  be  equivalent  to  that  given  here.  For  if  fi(U)  >  Bel(t/)  for  all  U  C  W 
then,  in  particular,  fi(U)  >  Bel(U ),  so  Plaus(f/)  =  1  —  Bel(f/)  >  1  —  =  l^(U). 
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Fig.  1.  Two  equivalent  definitions  of  probabilistic  expectation. 

Similarly,  we  can  check  that  Plaus(C/)  =  1  —  Bel (U)  =  (Peel)*-  There  is  an 
obvious  way  to  define  a  notion  of  expectation  based  on  belief  functions,  using  the 
identification  of  Bel  with  (Peel)*-  Given  a  belief  function  Bel,  define  Eqbi  =  EVb^. 
Similarly,  for  the  corresponding  plausibility  function  Plaus,  define  -Epiaus  =  E-pBel . 
(These  definitions  are  in  fact  used  by  Dempster  [1967]). 

This  is  well  defined,  but  it  seems  more  natural  to  get  a  notion  of  expectation  for 
belief  functions  that  is  defined  purely  in  terms  of  belief  functions,  without  reverting 
to  probability.  One  way  of  doing  so  is  due  to  Choquet  [1953]. 5 

It  takes  as  its  point  of  departure  the  following  alternate  definition  of  expecta¬ 
tion  in  the  case  of  probability.  Suppose  that  X  is  a  gamble  such  that  V(X)  = 
{aq, . .  with  aq  <  . . .  <  xn. 

Proposition  2.6.  E^(X)  =  xx  +  (x2-xi)ij,(X  >  xx)-\ - \-(xn-xn-i)fj,(X  > 

xn- 1). 

PROOF.  Figure  1  should  help  make  clear  why  this  result  is  true,  where  we  assume 
for  simplicity  that  the  worlds  W  =  {wx,w2,  ■  •  •}  are  ordered  such  that  if  X(w{)  < 
X(wj),  then  i  <  j.  If  we  assume  that  the  probability  of  a  world  w,  is  the  width 
of  the  vertical  rectangle  over  wq,  then  it  should  be  clear  that  the  total  area  of 
the  rectangles  represent  the  expectation  of  X.  Notice  that  the  vertical  rectangles 
determine  the  expectation  using  the  standard  definition  (2),  while  the  horizontal 
rectangles  determine  the  expectation  using  the  formula  in  this  proposition. 

For  a  more  formal  proof,  suppose  that  V(X)  =  {aq, . . .  ,xn}:  where  aq  <  . . .  < 
xn.  We  proceed  by  induction  on  n.  If  n  =  1,  the  result  is  trivial,  since  clearly 
Efj,(X)  =  xi.  If  n  >  1,  then  note  that  X  =  Xx  +  X2,  where  Xi(w)  =  X(w)  if 
X(w)  x„,  and  X\(w)  =  xn-i  if  X(w)  =  xn,  and  X2 (w)  =  0  if  X(w)  ^  xn, 
and  X(w)  =  xn  —  xn-\  if  X(w)  =  xn.  Clearly  X  =  X\  +  X2,  so  by  additivity, 
E(X)  =  E{Xi)  +  E{X2).  Note  that  V^X^  =  {aq, . . .  ,a;n_i},  so  by  the  induction 
hypothesis,  E^X])  =  X\  +  {x2  -  xx)ii(X  >  xx)  H - b  (x„_i  -  xn_2)n(X  >  xn_2). 


5Choquet  actually  talked  about  fc-monotone  capacities,  which  are  essentially  functions  that  satisfy 
B3  where  n  =  1, ...  ,k.  Belief  functions  are  infinitely  monotone  capacities. 
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Finally,  it  is  immediate  from  the  definition  of  X2  that  EM(A 2)  =  (xn  —  xn-i)p(X  > 
xn-i).  The  result  follows  immediately.  □ 

Define 

Epel(X)  =  xi  +  (x2  -  Xi)Bel(X  >  X\)  H - f  (xn  -  xn-i)Bel(X  >  z„_i).  (3) 

An  analogous  definition  holds  for  plausibility: 

£’piaus(^)  =  %i  +  (x2  -  xi)Plaus(X  >  xi)  + - 1-  (xn  -  xn_i)Plaus(Ar  >  xn_i). 

(4) 

Proposition  2.7.  [Schmeidler  1989]  EBei  =  EPel  and  EPlaus  =  Eplaus. 

Schmeidler  [1986;  1989]  actually  used  Choquet’s  definition  to  define  a  notion 
of  expectation  for  what  he  called  nonadditive  probabilities,  where  a  nonadditive 
probability  v  maps  subsets  of  a  space  W  to  [0, 1]  such  that  v(Z)  =  0,  u{W)  =  1, 
and  v(U)  <  v{V)  if  U  C  V.  He  proved  an  analogue  of  Proposition  2.7  for  arbitrary 
nonadditive  probabilities.  Since  belief  functions  and  plausibility  functions  are  both 
nonadditive  probabilities  in  Schmeidler’s  sense,  Proposition  2.7  is  actually  a  special 
case  of  Schmeidler’s  result. 

Proposition  2.7  shows  that  (3)  gives  a  way  of  defining  expectation  for  belief 
functions  without  referring  to  probability.  There  is  yet  a  third  way  of  defining 
expectation  for  belief  functions,  which  also  does  not  use  probability;  see  the  proof 
of  Theorem  6.2  in  Appendix  A. 4. 

Since  Esei  can  be  viewed  as  a  special  case  of  the  lower  expectation  Ep  (tak¬ 
ing  V  =  VBe\),  it  is  immediate  from  Proposition  2.3  that  -E'Bel  is  superadditive, 
positively  affinely  homogeneous,  and  monotone.  (Similar  remarks  hold  for  Epiaus, 
except  that  it  is  subadditive.  For  ease  of  exposition,  we  focus  on  E'Bel  in  the 
remainder  of  this  section,  although  analogous  remarks  hold  for  Epiaus.) 

Since  it  is  immediate  from  the  definition  that  EBe\(Xu)  =  Bel(Z7),  the  inclusion- 
exclusion  property  B3  of  belief  functions  can  be  expressed  in  terms  of  expectation 
(just  by  replacing  all  instances  of  Bel(V)  in  B3  by  EBei(AV)).  Moreover,  it  does  not 
follow  from  the  other  properties,  since  it  can  be  shown  not  to  hold  for  arbitrary  lower 
probabilities.  This  restatement  of  the  inclusion-exclusion  property  applies  only  to 
the  expectation  of  indicator  functions.  But,  in  fact,  a  more  general  inclusion- 
exclusion  property  holds  for  EBei-  Given  gambles  X  and  Y,  define  the  gambles 
X  AY  and  X  V  Y  as  the  minimum  and  maximum  of  X  and  Y,  respectively;  that 
is,  (XAF)(w)  =  niin(X(u>),y(u>))  and  (IVF)(w)  =  max(A(w),  Y(w)).  Consider 
the  following  inclusion-exclusion  property  for  expectation  functions: 

n 

S(V?=1^)>E  E  (— 1)<+1£(A  jeiXj).  (5) 

i=1  {/C{l,...,n}:|/|=i} 

Since  it  is  immediate  that  Xuuv  =  XjjV Xy  and  Xunv  =  Xjj  AXy,  (5)  generalizes 
B3.  We  recover  B3  from  (5)  by  taking  X,  to  be  the  indicator  function  Xjj.. 

There  is  yet  another  property  satisfied  by  expectation  functions  based  on  belief 
functions.  Two  gambles  X  and  Y  are  said  to  be  comonotonic  if  it  is  not  the  case 
that  one  increases  while  the  other  decreases.  Formally,  this  means  that  there  do 
not  exist  worlds  w  and  w'  such  that  (X(w)  —  X(w'))(Y(w)  —  Y(w '))  <  0.  The 
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property  satisfied  by  expectation  based  on  belief  functions  is  called  comonotonic 
additivity. 

If  X  and  Y  are  comonotonic,  then  E(X  +  Y)  =  E{X)  +  E(Y).  (6) 

The  fact  that  -Euei  satisfies  this  property  was  essentially  recognized  by  Dellacherie 
[1970]. 

Proposition  2.8.  The  function  -Enel  is  superadditive,  positively  affinely  homo¬ 
geneous,  monotone,  and  satisfies  (5)  and  (6). 6 

PROOF.  See  Appendix  A.l.  □ 

Theorem  2.9.  Suppose  that  E  is  an  expectation  function  that  is  positively  affinely 
homogeneous,  monotone,  and  satisfies  (5)  and  (6).  Then  there  is  a  (necessarily 
unique)  belief  function  Bel  such  that  E  =  I?Bei- 

Proof.  See  Appendix  A.l.  □ 

Schmeidler  [1986]  proved  that  expectation  functions  for  nonadditive  measures 
are  characterized  by  positive  affine  homogeneity,  monotonicity,  and  comonotonicity. 
Theorem  2.9  shows  that  the  inclusion-exclusion  property  (5)  is  what  distinguishes 
expectation  for  belief  functions  from  expectation  for  arbitrary  nonadditive  mea¬ 
sures.  Note  that  superadditivity  was  not  assumed  in  the  statement  of  Theorem  2.9. 
Indeed,  it  is  a  consequence  of  Theorem  2.9  that  superadditivity  follows  from  the 
other  properties.  In  fact,  the  full  stength  of  positive  affine  homogeneity  is  not 
needed  either  in  Theorem  2.9.  It  suffices  to  assume  that  E(b)  =  b. 

Corollary  2.10.  Given  a  belief  function  Bel,  E^ei  is  the  unique  expectation 
function  E  that  is  superadditive,  positively  affinely  homogeneous,  monotone,  and 
satisfies  (5)  and  (6)  such  that  E(Xjj)  =  Bel(t/)  for  all  U  C  W. 

PROOF.  Proposition  2.8  shows  that  Esei  has  the  required  properties.  If  E'  is 
an  expectation  function  that  has  these  properties,  by  Theorem  2.9,  E'  =  E-Qev  for 
some  belief  function  Bel/.  Since  E'(Xu)  =  Bel^t/)  =  Bel(Z7)  for  all  U  C  W,  it 
follows  that  Bel  =  Belb  □ 

Corollary  2.10  is  somewhat  surprising.  While  it  is  almost  immediate  that  an 
additive,  affinely  homogeneous  expectation  function  (the  type  that  arises  from  a 
probability  measure)  is  determined  by  its  behavior  on  indicator  functions,  it  is 
not  at  all  obvious  that  a  superadditive,  positively  affine  homogeneous  expectation 
function  should  be  determined  by  its  behavior  on  indicator  functions.  In  fact,  in 
general  it  is  not;  the  inclusion-exclusion  property  is  essential.  Corollary  2.10  says 
that  Bel  and  £Bei  contain  the  same  information.  Thus,  so  do  (PBei)*  and  fk-pn^ 
(since  Bel  =  (Psei)*  and  Eqbi  =  EVbb1).  However,  this  is  not  true  for  arbitrary  sets 
V  of  probability  measures,  as  the  following  example  shows. 

Example  2.11.  Let  W  =  {1,2,3}.  A  probability  measure  p  on  W  can  be 
characterized  by  a  triple  (01,02,03),  where  p(i)  =  a^.  Let  V  consist  of  the  three 


6  In  a  preliminary  version  of  this  paper  [Halpern  and  Pucella  2002b]  we  used  a  different  character¬ 
ization  of  expectation  functions,  based  on  belief  functions.  The  current  characterization  is  much 
simpler. 
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probability  measures  (0,  3/8, 5/8),  (5/8, 0,  3/8),  and  (3/8, 5/8,  0).  It  is  almost  imme¬ 
diate  that  V*  is  0  on  singleton  subsets  of  W  and  V*  =  3/8  for  doubleton  subsets.  Let 
V  =  VL){p4},  where  /14  =  (5/8,  3/8, 0).  It  is  easy  to  check  that  V(  =V*.  However, 
Elv  7^  Ev  In  particular,  let  X  be  the  gamble  such  that  X(l)  =  1,  X(2)  =  2,  and 
X(3)  =  3.  Then  EV(X)  =  13/8  but  EV,(X)  =  11/8.  Thus,  although  Ev  and 
Ep>  agree  on  indicator  functions,  they  do  not  agree  on  all  gambles.  In  light  of  the 
discussion  above,  it  should  be  no  surprise  that  V *  is  not  a  belief  function.  | 

2.4  Expectation  for  Possibility  Measures 

A  possibility  measure  Poss  is  a  function  from  subsets  of  W  to  [0, 1]  such  that 

Possl.  Poss(0)  =  0. 

Poss2.  Poss(IT)  =  1. 

Poss3.  Poss({7  U  V)  =  max(Poss(C/),  Poss(F))  if  U  and  V  are  disjoint. 

It  is  not  hard  to  show  that  Poss3  implies  that  Poss(LrUP)  =  max(Poss(t/),  Poss(P)) 
even  when  U  and  V  are  not  disjoint. 

It  is  well  known  [Dubois  and  Prade  1982]  that  possibility  measures  are  special 
cases  of  plausibility  functions.  Thus,  (4)  can  be  used  to  define  a  notion  of  possi- 
bilistic  expectation;  indeed,  this  has  been  done  in  the  literature  [Dubois  and  Prade 
1987].  It  is  also  straightforward  to  see  from  Poss3  that  the  expectation  function 
-Eposs  defined  from  a  possibility  measure  Poss  in  this  way  satisfies  the  following  max 
property  defined  in  terms  of  indicator  functions: 


EpOSs{Xuuv)  =  rnax(Eposs{Xu) ,  EPoss(Xv) ■  (7) 

Proposition  2.12.  The  function  Eposs  is  positively  affinely  homogeneous,  mono¬ 
tone,  and  satisfies  (6)  and  (7). 

PROOF.  See  Appendix  A.l.  □ 

Theorem  2.13.  Suppose  that  E  is  an  expectation  function  that  is  positively 
affinely  homogeneous,  monotone,  and  satisfies  (6)  and  (7).  Then  there  is  a  (neces¬ 
sarily  unique)  possibility  measure  Poss  such  that  E  =  Eposs. 

Proof.  See  Appendix  A.l.  □ 

Note  that,  although  Poss  is  a  plausibility  measure,  and  thus  satisfies  the  analogue 
of  (5)  with  >  replaced  by  <,  there  is  no  need  to  state  (5)  explicitly;  it  follows 
from  (7).  Moreover,  just  as  with  expectation  for  belief  functions,  it  follows  from 
the  other  properties  that  Eposs  is  subadditive.  (Since  a  possibility  measure  is  a 
plausibility  function,  not  a  belief  function,  the  corresponding  expectation  function 
is  subadditive  rather  than  superadditive.) 

3.  A  LOGIC  FOR  REASONING  ABOUT  EXPECTATION 

We  now  consider  a  logic  for  reasoning  about  expectation.  To  set  the  stage,  we 
briefly  review  the  FHM  logic  for  reasoning  about  likelihood. 
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3.1  Reasoning  about  Likelihood 

The  syntax  of  the  FHM  logic  is  straightforward.  Fix  a  set  <Fo  =  {pi,P2,  ■  ■  ■}  of 
primitive  propositions.  The  choice  of  primitive  propositions  is  application  depen¬ 
dent.  The  set  of  primitive  propositions  could  include  statements  such  as  “the 
patient  has  cancer”  and  “the  patient  has  fever”  if  we  are  reasoning  in  a  medical 
domain,  or  statements  such  as  “the  price  of  IBM  stock  is  over  $80”  if  we  are 
considering  a  financial  domain.  The  set  $  of  propositional  formulas  is  the  closure 
of  $0  under  A  and  We  can  define  V  and  =>•  in  the  usual  way;  we  use  the 
operators  freely  throughout  the  paper.  We  assume  a  special  propositional  formula 
true,  and  abbreviate  Airue  as  false.  A  basic  likelihood  formula  has  the  form 
a\t(}p\)  +  •  •  •  +  ak£(<pk)  >  b,  where  aq, . . . ,  ak,  b  are  integers  and  ip i, . . .  ,ipk  are 
propositional  formulas. '  The  £  stands  for  likelihood.  Thus,  a  basic  likelihood 
formula  talks  about  a  linear  combination  of  likelihood  terms  of  the  form  £i{<p).  A 
likelihood  formula  is  a  Boolean  combination  of  basic  likelihood  formulas.  Let  CPU 
be  the  language  consisting  of  likelihood  formulas.  (The  QU  stands  for  quantitative 
uncertainty.  The  name  for  the  logic  is  taken  from  Halpern  [2003].) 

We  use  standard  abbreviations  such  as  —  £(ip)  for  (—l)£(tp),  and  formulas  £{pi)  > 
£(<pi)  for  £{ip i)  —  £(ip 2)  >  0.  In  addition,  we  write  a\£{ipi)  +  . . .  +  ak£(pk)  <  b  for 
-ai£(v?i)  -  ...  -  ak£(ipk)  >  -b,  aif(<£i)  +  . . .  +  ak£(<pk)  >  b  for  ~>(a1£(p1)  +  . . .  + 
ak£(ipk)  <  b),  aii(ipi)  +  . . .  +  ak£(ipk)  <  b  for  -a^ipi)  -  ...  -  ak£(<pk)  >  - b ,  and 
ai£{ipi)  +  . . .  +  ak£(pk)  =  b  for  (aii(ifii)  +  . . .  +  ak£(ipk)  >  b)  A  {ai£(ipi)  +  . . .  + 
ak£(ipk)  <  b). 

The  semantics  of  £®u  depends  on  how  £  is  interpreted.  In  FHM,  it  is  interpreted 
as  a  probability  measure  and  as  a  belief  function;  in  HP,  it  is  interpreted  as  an 
upper  probability  (determined  by  a  set  of  probability  measures).  Depending  on  the 
interpretation,  £(ip)  is  the  probability  of  <p  (i.e.,  more  precisely,  the  probability  of 
the  set  of  worlds  where  ip  is  true),  the  belief  in  ip,  etc.  For  example,  in  the  case 
of  probability,  define  a  probability  structure  to  be  a  tuple  M  =  (W,£F,p,  n),  where 
IF  is  a  (possibly  infinite)  set  of  worlds,  p  is  a  probability  measure  whose  domain 
is  the  algebra  T  of  subsets  of  W ,  and  7r  is  an  interpretation ,  which  associates  with 
each  state  (or  world)  in  IF  a  truth  assignment  on  the  primitive  propositions  in  $0. 
Thus,  7r(s)(p)  €  {true,  false}  for  s  €  W  and  p  £  <I>o.  We  require  that  primitive 
propositions  be  measurable,  that  is,  that  {s  G  W  :  n(s)(p)  =  true}  €  T  for  all 
p  G  $0-  Extend  7r(s)  to  a  truth  assignment  on  all  propositional  formulas  in  the 
standard  way,  and  associate  with  each  propositional  formula  the  set  \p\m  =  {s£ 
W  :  Tr(s)(ip)  =  true}.  Note  that  [</?]m  is  measurable  for  all  p  since  T  is  an 
algebra.  Then 

M  1=  ai£(pi)  -\ - 1-  an£(ipn)  >  b  iff  ai/i([^i]M)  H - L  anp(\pn\M)  >  b. 

The  semantics  of  Boolean  combinations  of  basic  likelihood  formulas  is  given  in  the 

7 As  observed  in  FHM,  we  gain  no  further  generality  by  allowing  the  coefficients  01, . . . ,  ak  to  be 
rational  numbers,  since  for  any  formula  with  rational  coefficients,  we  can  easily  find  an  equivalent 
formula  with  coefficients  that  are  integers  by  clearing  the  dominator.  There  is  no  difficulty  giving 
semantics  to  formulas  where  the  coefficients  are  arbitrary  real  numbers  (and,  indeed,  this  is  what 
we  did  in  a  preliminary  version  of  the  paper  [Halpern  and  Pucella  2002b]),  but  allowing  real 
numbers  causes  problems  in  the  complexity  results.  (In  the  preliminary  version,  we  restricted  to 
integer  coefficients  for  the  complexity  results.) 
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obvious  way. 

We  can  similarly  give  semantics  to  t  using  lower  (or  upper)  probability.  Define 
a  lower  probability  structure  to  be  a  tuple  M  =  (W,IF,V,  n),  W,  T  and  tt  are, 
as  before,  a  (possibly  infinite)  set  of  worlds,  an  algebra  of  subsets  of  W,  and  an 
interpretation  that  makes  each  primitive  proposition  measurable,  and  V  is  a  set  of 
probability  measures  over  T .  Likelihood  is  interpreted  as  lower  probability  in  lower 
probability  structures:8 

M  \=  ai£(v?i)  H - b  an£(<pn)  >  b  iff  aiV*{{if>i\M)  H - b  anV*(\ipn_ 1m)  >  b. 

A  belief  structure  has  the  form  M  =  (W.  Bel,  7r),  where  Bel  is  a  belief  function. 
We  can  interpret  likelihood  formulas  with  respect  to  belief  structures  in  the  obvious 
way.  Similarly,  a  possibility  structure  has  the  form  M  =  (W,  Poss,7r),  where  Poss 
is  a  possibility  measure.  Again,  we  interpret  likelihood  formulas  with  respect  to 
possibility  structures  in  the  obvious  way. 

Let  A4prob,  Mlp ,  A4bel,  and  JV[poss  denote  the  set  of  all  probability  structures, 
lower  probability  structures,  belief  structures,  and  possibility  structures,  respec¬ 
tively. 

3.2  Reasoning  about  Expectation 

Our  logic  for  reasoning  about  expectation  is  similar  in  spirit  to  C®u .  The  idea  is  to 
interpret  a  propositional  formula  <p  as  the  indicator  function  A[V]M,  which  is  1  in 
worlds  where  ip  is  true,  and  0  otherwise.  We  can  then  take  linear  combinations  of 
such  gambles.  Formally,  we  again  start  with  a  set  (f>o  of  primitive  propositions.  A 
( linear )  propositional  gamble  has  the  form  biipi  +  ■  ■  ■  +  bnipn,  where  b\, . . . ,  bn  are 
integers  and  ip\ , . . . ,  ipn  are  propositional  formulas  that  mention  only  the  primitive 
propositions  in  <f>o.  We  use  7  to  represent  propositional  gambles.  An  expectation 
inequality  is  a  statement  of  the  form  aie(7i)  +  •  •  •  +  ake{ 7*,)  >  &,  where  ai . . . ,  a*, 
are  integers,  k  >  1,  and  b  is  an  integer.  An  expectation  formula  is  a  Boolean 
combination  of  expectation  inequalities.  We  use  /  and  g  to  represent  expectation 
formulas.  We  define  <,  >,  <,  and  =  just  as  in  Section  3.1,  Let  CE  be  the  language 
consisting  of  expectation  formulas. 

Given  a  model  M,  we  associate  with  a  propositional  gamble  7  the  gamble  {^m, 

where  - b  bnipn\M  =  biX^^^ - kbnX^VniM.  Of  course,  the  intention  is 

to  interpret  e(y)  in  M  as  the  expected  value  of  the  gamble  {]7[|-m,  where  the  notion 
of  “expected  value”  depends  on  the  underlying  semantics.  In  the  case  of  probability 
structures,  it  is  probabilistic  expectation;  in  the  case  of  belief  structures,  it  is 
expected  belief;  in  the  case  of  lower  probability  structures,  it  is  lower  expectation; 
and  so  on.  For  example,  if  M  €  A4prob,  then 

M  \=  aie(7i)  -I - b  ake(jk)  >  b  iff  a1Efl(^1lM)  H - b  akE^({ \^k\M)  >  b. 

Again,  Boolean  combinations  are  defined  in  the  obvious  way.  We  leave  the 
obvious  semantic  definitions  in  the  case  of  belief  structures  and  lower  probability 
structures  to  the  reader. 


8  In  HP,  we  interpreted  likelihood  as  upper  probability.  We  interpret  it  here  as  lower  probability 
to  bring  out  the  connections  to  belief,  which  is  an  instance  of  lower  probability.  It  is  easy  to 
translate  from  upper  probabilities  to  lower  probabilities  and  vice  versa,  since  V*(U)  =  1  —  V*(U). 
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4.  EXPRESSIVE  POWER 

It  is  easy  to  see  that  CE  is  at  least  as  expressive  as  CQU .  Since  the  expected  value 
of  an  indicator  function  is  its  likelihood,  for  all  the  notions  of  likelihood  we  are 
considering,  replacing  all  occurrences  of  £(ip)  in  a  formula  in  £^u  by  e(ip)  gives  an 
equivalent  formula  in  CE .  Is  CE  strictly  more  expressive  than  C^ul  That  depends 
on  the  underlying  semantics. 

In  the  case  of  probability,  it  is  easy  to  see  that  it  is  not.  Using  additivity  and 
affine  homogeneity,  it  is  easy  to  take  an  arbitrary  formula  /  £  CE  and  find  a  formula 
/'  £  CE  that  is  equivalent  to  /  (with  respect  to  structures  in  Mprob)  such  that  e 
is  applied  only  to  propositional  formulas.  Then  using  the  equivalence  of  e{ip)  and 
£(<p),  we  can  find  a  formula  fT  £  £^u  equivalent  to  /  with  respect  to  structures 
in  Aiprob.  It  should  be  clear  that  the  translation  /  to  fT  causes  at  most  a  linear 
blowup  in  the  size  of  the  formula. 

The  same  is  true  if  we  interpret  formulas  with  respect  to  A46ei  and  Jtiposs.  In  both 
cases,  given  a  formula  /  £  CE ,  we  can  use  (6)  to  find  a  formula  f  £  CE  equivalent 
to  /  such  that  e  is  applied  only  to  propositional  formulas  (see  Lemma  A. 5  in  the 
appendix).  It  is  then  easy  to  find  a  formula  fT  £  L^u  equivalent  to  f  with  respect 
to  structures  in  A tbel  and  Aiposs.  However,  now  the  translation  from  /  to  fT  can 
cause  an  exponential  blowup  in  the  size  of  the  formula;  we  do  not  know  if  there  is 
a  shorter  translation. 

What  about  lower  expectation/probability?  In  this  case,  CE  is  strictly  more 
expressive  than  CPU .  It  is  not  hard  to  construct  two  structures  in  J\Alp  that  agree 
on  all  formulas  in  CPU  but  disagree  on  formulas  in  CE  such  as  e(p+q)  >  1/2.  That 
means  that  there  cannot  be  a  formula  in  CPU  equivalent  to  e(p  +  q)  >  1/2. 

The  following  theorem  summarizes  this  discussion. 

Theorem  4.1.  CE  and  CQU  are  equivalent  in  expressive  power  with  respect  to 
Mprob ,  Mbel,  and  Mposs .  CE  is  strictly  more  expressive  than  C®u  with  respect  to 
Mlp. 

Proof.  See  Appendix  A. 2.  □ 

5.  AXIOMATIZING  EXPECTATION 

In  FHM,  a  sound  and  complete  axiomatization  is  provided  for  CPU  both  with 
respect  to  Mprob  and  Mbel;  in  HP,  a  sound  and  complete  axiomatization  is  provided 
for  C®u  with  respect  to  Mlp .  Here  we  provide  a  sound  and  complete  axiomatization 
for  CE  with  respect  to  these  structures,  as  well  as  with  respect  to  A4poss . 

The  axiomatization  for  CQU  given  in  FHM  splits  into  three  parts,  dealing  re¬ 
spectively  with  propositional  reasoning,  reasoning  about  linear  inequalities,  and 
reasoning  about  likelihood.  We  follow  the  same  pattern  here.  The  following  axioms 
characterize  propositional  reasoning: 

Taut.  All  instances  of  propositional  tautologies  in  the  language  CE . 

MP.  From  /  and  f  =>  g  infer  g. 

Instances  of  Taut  include  all  formulas  of  the  form  /V->/,  where  /  is  an  expectation 
formula.  We  could  replace  Taut  by  a  simple  collection  of  axioms  that  characterize 
propositional  reasoning  (see,  for  example,  Mendelson  [1964]),  but  we  have  chosen 
to  focus  on  aspects  of  reasoning  about  expectations. 
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The  following  axiom  characterizes  reasoning  about  linear  inequalities: 

Ineq.  All  instances  in  CE  of  valid  formulas  about  linear  inequalities. 

This  axiom  is  taken  from  FHM.  There,  an  inequality  formula  is  taken  to  be  a 
Boolean  combination  of  formulas  of  the  form  a\X\  +  •  •  •  +  anxn  >  c,  over  variables 
Xi, . . .  ,xn.  Such  a  formula  is  valid  if  the  resulting  inequality  holds  under  every 
possible  assignment  of  real  numbers  to  variables.  To  get  an  instance  of  Ineq,  we 
replace  each  variable  x-i  that  occurs  in  a  valid  formula  about  linear  inequalities  by 
a  primitive  expectation  term  of  the  form  e(q f)  (naturally  each  occurrence  of  the 
variable  27  must  be  replaced  by  the  same  primitive  expectation  term  e(q j)).  As  with 
Taut,  we  can  replace  Ineq  by  a  sound  and  complete  axiomatization  for  Boolean 
combinations  of  linear  inequalities.  One  such  axiomatization  is  given  in  FHM.  It  is 
described  in  Section  7;  the  details  do  not  matter  for  the  discussion  in  this  section. 

The  following  axioms  characterize  probabilistic  expectation  in  terms  of  the  prop¬ 
erties  described  in  Proposition  2.1. 

El.  e(7i  +  y2)  =  e(7i)  +  e(72), 

E2.  e(a<p)  =  ae(ip)  for  all  o£l, 

E3.  e(false)  =  0, 

E4.  e(true)  =  1, 

E5.  e(7i)  <  e(72)  if  71  <  72  is  an  instance  of  a  valid  formula  about  propositional 
gamble  inequality  (see  below). 

Axiom  El  is  simply  additivity  of  expectations.  Axioms  E2,  E3,  and  E4,  in  conjunc¬ 
tion  with  additivity,  capture  affine  homogeneity.  Axiom  E5  captures  monotonicity. 
A  propositional  gamble  inequality  is  a  formula  of  the  form  71  <72,  where  71  and 
72  are  propositional  gambles.  Examples  of  valid  propositional  gamble  inequalities 
are  p  =  p  A  q  +  p  A  -> q,  p  <  p  +  ip,  and  <p  <  p  V  ip.  We  define  the  semantics 
of  gamble  inequalities  more  carefully  in  Section  7,  where  we  provide  a  complete 
axiomatization  for  them.  As  in  the  case  of  Ineq,  we  can  replace  E5  by  a  sound 
and  complete  axiomatization  for  Boolean  combinations  of  gamble  inequalities. 

Let  AX.prob  be  the  axiomatization  {Taut,  MP,  Ineq,  El,  E2,  E3,  E4,  E5}.  As 
usual,  given  an  axiom  system  AX,  we  say  that  a  formula  /  is  A IX-provable  if  it  can 
be  proved  in  finitely  many  steps  using  the  axioms  and  rules  of  inferences  of  AX. 
AX  is  sound  with  respect  to  a  class  A4  of  structures  if  every  AX-provable  formula 
is  valid  in  A4 .  AX  is  complete  with  respect  to  A4  if  every  formula  that  is  valid  in 
M  is  AX-provable. 

Theorem  5.1.  AX.prob  is  a  sound  and  complete  axiomatization  of  CE  with 
respect  to  Mprob . 

PROOF.  See  Appendix  A. 3.  □ 

9We  could  have  taken  a  more  complex  language  that  contains  both  expectation  formulas  and 
gamble  inequalities.  We  could  then  merge  the  axiomatizations  for  expectation  formulas  and  gamble 
inequalities.  For  simplicity,  and  to  clarify  the  relationship  between  reasoning  about  expectation 
versus  reasoning  about  likelihood  (see  Section  4),  we  consider  only  the  restricted  language  in  this 
paper. 
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Despite  the  fact  that  we  allow  structures  that  have  infinitely  many  worlds,  we 
do  not  have  axioms  capturing  the  continuity  properties  of  expectations  that  hold 
for  expectations  over  infinite  spaces.  Roughly  speaking,  this  is  because  the  logic 
cannot  distinguish  between  infinite  sample  spaces  and  finite  ones.  We  make  this 
intuition  precise  in  Section  6. 

The  characterizations  of  Theorems  2.4  and  2.9  suggest  the  appropriate  axioms 
for  reasoning  about  lower  expectations  and  expected  beliefs.  The  following  axioms 
capture  the  properties  specified  in  Proposition  2.3: 

E6.  e(7i  +  72)  >  e(7i)  +  e(72), 

E7.  e(a7  +  b  true)  =  ae( 7)  +  b ,  for  all  a,  b  €  R,  a  >  0, 

E8.  e(a7  +  b  false )  =  ae(7),  for  all  a,  b  G  R,  a  >  0. 

Axiom  E6  is  superadditivity  of  the  expectation.  Axioms  E7  and  E8  capture 
positive  affine  homogeneity.  Note  that  because  we  do  not  have  additivity,  we 
cannot  get  away  with  simpler  axioms  as  in  the  case  of  probability.  Monotonicity  is 
captured,  as  in  the  case  of  probability  measures,  by  axiom  E5.  Let  AX!p  be  the 
axiomatization  {Taut,  MP,  Ineq,  E5,  E6,  E7,  E8}. 

Theorem  5.2.  AXlp  is  a  sound  and  complete  axiomatization  of  CE  with  respect 
to  Mlp. 

Proof.  See  Appendix  A. 3.  □ 

Although  it  would  seem  that  Theorem  5.2  should  follow  easily  from  Proposi¬ 
tion  2.3,  this  is,  unfortunately,  not  the  case.  As  usual,  soundness  is  straightforward, 
and  to  prove  completeness,  it  suffices  to  show  that  if  a  formula  /  is  consistent  with 
AXip,  it  is  satisfiable  in  a  structure  in  A4lp .  Indeed,  it  suffices  to  consider  formulas  / 
that  are  conjunctions  of  expectation  inequalities  and  their  negations.  However,  the 
usual  approach  for  proving  completeness  in  modal  logic,  which  involves  considering 
maximal  consistent  sets  and  canonical  structures  does  not  work.  The  problem  is 
that  there  are  maximal  consistent  sets  of  formulas  that  are  not  satisfiable.  For 
example,  there  is  a  maximal  consistent  set  of  formulas  that  includes  e(7)  >  0  and 
e(7)  <  1  jn  for  n  =  1, 2, . . .;  this  is  clearly  unsatisfiable.  A  similar  problem  arises  in 
the  completeness  proofs  for  CPU  given  in  FHM  and  HP,  but  the  techniques  used 
there  do  not  seem  to  suffice  for  dealing  with  expectations. 

Of  course,  it  is  the  case  that  any  expectation  function  that  satisfies  the  constraints 
in  the  formula  /  and  also  every  instance  of  axioms  E6,  E7,  and  E8  must  be  a  lower 
expectation,  by  Theorem  2.4.  The  problem  is  that,  a  priori,  there  are  infinitely 
many  relevant  instances  of  the  axioms.  To  get  completeness,  we  must  reduce  this 
to  a  finite  number  of  instances  of  these  axioms.  It  turns  out  that  this  can  be  done, 
using  techniques  from  linear  programming  and  Walley’s  [1991]  notion  of  natural 
extension. 

It  is  also  worth  noting  that,  although  CE  is  a  more  expressive  language  than  CPU 
in  the  case  of  lower  probability/expectation,  the  axiomatization  for  CE  in  this  case 
is  much  more  elegant  than  the  corresponding  axiomatization  for  CPE  given  in  HP. 

We  next  consider  expectation  with  respect  to  belief.  As  expected,  the  axioms 
capturing  the  interpretation  of  belief  expectation  rely  on  the  properties  pointed  out 
in  Proposition  2.8.  Stating  these  properties  in  the  logic  requires  a  way  to  express 
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the  max  and  min  of  two  propositional  gambles.  It  turns  out  that  we  can  view 
the  notation  71  V  72  as  an  abbreviation  for  a  more  complex  expression.  Given  a 
propositional  gamble  7  =  bipi  +  •  •  •  +  bnpn ,  we  construct  an  equivalent  gamble 
7'  as  follows.  First  define  a  family  pA  of  propositional  formulas  indexed  by  A  C 
{1,  ■  ■  ■ ,  n}  by  taking  pA  =  /\ieA  Pi  A  (A^a  Thus,  pA  is  true  exactly  if  the 

Pi’s  for  i  £  A  are  true,  and  the  other  pj’s  are  false.  Note  that  the  formulas  pA  are 
mutually  exclusive.  Define  bA  for  A  C  {1, . . . ,  n}  by  taking  bA  =  A  bi.  Define 
y  =  XAc{i  bApA.  It  is  easy  to  check  that  the  propositional  gambles  7  and  7' 
are  equal.  Given  two  propositional  gambles,  say  71  and  72,  we  can  assume  without 
loss  of  generality  that  the  involve  the  same  primitive  propositions  p\, ... ,  pn.  (If 
not,  we  can  always  add  “dummy”  terms  of  the  form  0^.)  Form  the  gambles  7}  and 
72  as  above.  Since  all  the  formulas  mentioned  in  7}  and  72  are  mutually  exclusive, 
it  follows  that  max(7{,  72)  =  XAc{i  n }  max(bA,b'A)pA.  We  take  71  V  72  to  be  an 
abbreviation  for  this  gamble.  (Note  that  if  71  and  72  are  propositional  formulas, 
then  71 V  72  really  is  a  gamble  equivalent  to  the  propositional  formula  71 V  72 ,  given 
our  identification  of  propositional  formulas  with  indicator  functions,  so  the  use  of 
V  is  justified  here.)  Of  course,  we  can  similarly  define  71 A  72,  simply  by  taking  min 
instead  of  max. 

With  these  definitions,  the  following  axiom  accounts  for  property  (5): 

E9.  e(7i  V  •  •  •  V  7„)  >  £”=i  E{/c{i,...,„}:|/|=i}(-Oi+1e(Aje/  7#)- 

To  deal  with  the  comonotonic  additivity  property  (6),  it  seems  that  comonotonicity 
must  be  expresssed  in  the  logic.  It  turns  out  that  it  suffices  to  capture  only  a 
restricted  form  of  comonotonicity.  Note  that  if  p  1 , . . . ,  pm  are  pairwise  mutually 
exclusive,  a\  <  ...  <  am,  bi  <  ...  <  bm,  71  =  a\p\  +  •  •  •  +  ampm,  and  72  = 
b\p\  +  ■  ■  ■  +  bmPm,  then  in  all  structures  M,  the  gambles  {71  and  {72  }m  are 
comonotonic.  Thus,  by  (6),  it  follows  that  EBei(-{|7i  +72 |}m)  =  -E^Bei(-{|'Yi D"m)  + 
T'Bei  ( {]  72 1}  m  )  ■  The  proof  that  I^Bei  satisfies  comonotonic  additivity  (see  the  proof 
of  Theorem  2.9  in  the  appendix)  shows  that  it  suffices  to  restrict  to  gambles  of  this 
form.  These  observations  lead  to  the  following  axiom: 

E10.  e(7i+72)  =  e(7i)  +  e(72)  if  71  =  ai¥>iH - \-ampm,  72  =  - \-bmpm, 

ai  <  •  ■  •  <  am,  b\  <  . . .  <  brn ,  and  _i(</?i  A  pj)  is  a  propositional  tautology 
for  all  i  y  j. 

Let  AXftei  be  the  axiomatization  {Taut,  MP,Ineq,  E5,  E7,  E8,  E9,  E10}. 

Theorem  5.3.  AX6ei  is  a  sound  and  complete  axiomatization  of  CE  with  respect 
to  Mbel. 

Proof.  See  Appendix  A. 3.  □ 

Finally,  we  consider  expectation  with  respect  to  possibility.  The  axioms  capturing 
the  interpretation  of  possibilistic  expectation  Eposs  rely  on  the  properties  pointed 
out  in  Proposition  2.12.  The  max  property  (7)  is  captured  by  the  following  axiom: 

Ell.  (e(pi)  >  e(p2))  =>  (e(p!  V  p2)  =  e(p1)). 

Ell  essentially  says  that  e(p\  V  p2)  =  max(e(<pi),  e(p2)). 

Let  AX.poss  be  the  axiomatization  {Taut,  MP,  Ineq,  E5,  E7,  E8,  E10,  Ell}. 
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Theorem  5.4.  AXposs  is  a  sound  and  complete  axiomatization  of  CE  with 
respect  to  Mposs . 

PROOF.  See  Appendix  A. 3.  □ 

6.  DECISION  PROCEDURES 

In  FHM,  it  was  shown  that  the  satisfiability  problem  for  C^u  is  NP-complete,  both 
with  respect  to  JV[prob  and  A4bel",  in  HP,  NP-completeness  was  also  shown  with 
respect  to  Mlp .  Here  we  prove  similar  results  for  the  language  CE .  In  the  case 
of  Aiprob,  this  is  not  at  all  surprising,  given  Theorem  4.1  and  the  fact  that  the 
translation  from  CE  to  CPU  causes  only  a  linear  blowup  in  the  case  of  JV[prob . 
However,  we  cannot  get  the  result  for  J\Abel  or  JHposs  from  Theorem  4.1,  since 
the  translation  causes  an  exponential  blowup.  Of  course,  in  the  case  of  Ji4lp,  no 
translation  exists  at  all.  Nevertheless,  in  all  these  cases,  we  can  get  NP-completeness 
using  techniques  very  much  in  the  spirit  of  the  linear  programming  techniques  used 
in  FHM. 

We  define  |/|  to  be  the  length  of  /,  that  is,  the  number  of  symbols  required  to 
write  /,  where  each  coefficient  is  counted  as  one  symbol.  Define  ||/||  to  be  the 
length  of  the  longest  coefficient  appearing  in  /,  when  written  in  binary.  The  size  of 
a  rational  number  |,  denoted  |||||,  where  a  and  b  are  relatively  prime,  is  defined 
to  be  ||a||  +  ||6||. 

The  next  theorems,  helpful  to  establish  the  complexity  of  the  decision  procedures, 
show  that  the  logic  is  not  expressive  enough  to  distinguish  between  infinite  sample 
spaces  and  infinite  ones;  if  a  formula  is  satisfiable  at  all,  it  is  satisfiable  in  a 
(relatively  small)  finite  structure.  In  other  words,  we  could  have  restricted  to 
structures  with  only  finitely  many  worlds  without  loss  of  generality.  We  prove  this 
result  for  A4lp,  A4bel,  and  A4poss;  it  follows  from  Fagin  et  al.  [1990,  Theorem  2.4] 
(which  shows  that  a  formula  in  the  language  CPU  is  satisfiable  in  M.prob  iff  it  is 
satisfiable  in  a  finite  structure  in  J\Aprob)  and  Theorem  4.1  (which  shows  that  every 
formula  in  CE  is  equivalent  to  a  formula  in  C^u  for  structures  in  M.prob)  that  the 
result  holds  for  J\Aprob  as  well. 

Theorem  6.1.  Suppose  that  f  £  CE  is  satisfied  in  some  structure  in  Ailp .  Then 
f  is  satisfied  in  a  structure  (W,V,n)  such  that  \W\  <  \f\2,  \P\  <  |/|,  p(uf)  is 
a  rational  number  such  that  ||/z(tw)||  is  0(|/|2||/||  +  |/|2 log ( | / 1 ) )  for  every  world 
w  £  W  and  p  £  V,  and  n(w)(p)  =  false  for  every  world  w  £  W  and  every  primitive 
proposition  p  not  appearing  in  f. 

Proof.  See  Appendix  A. 4.  □ 

To  prove  a  small-model  theorem  for  belief  functions  (and  possibility  measures),  we 
need  a  representation  of  belief  functions  that  is  particularly  compact.  Given  a  set  W 
of  worlds,  a  mass  function  m  is  a  function  from  2W  to  [0, 1]  such  that  m(0)  =  0,  and 
Ylu<zwm(U)  =  1  [Shafer  1976].  As  is  well  known,  in  finite  spaces,  there  is  a  one- 
to-one  correspondence  between  belief  functions  and  mass  functions  [Shafer  1976]. 
Given  a  mass  function  m,  let  Belm  be  the  set  function  defined  by  setting  Bel,,,  ( U )  = 
J2vcu  m(y)-  It  can  t>e  shown  that  Belm  is  a  belief  function  (in  particular,  it 
satisfies  B3).  Conversely,  given  a  belief  function  Bel,  consider  the  set  function  m^e \ 
defined  by  setting  TOBei(0)  =  0,  and  m^e\{U)  =  Bel(tZ)  —  Y^vcu  mBei(I0-  It  can 
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be  shown  that  rriBe  1  is  a  mass  function  (in  particular,  mnei  ( U )  >  0  for  all  U)  and 
that  BelmBel  =  Bel.  It  easily  follows  that  the  mappings  Bel  i— >  meei  and  m  i— >  Belm 
give  a  one-to-one  correspondence  between  belief  function  and  mass  functions. 

Theorem  6.2.  Suppose  that  f  £  CE  is  satisfied  in  some  structure  in  A4bel 
(resp.,  Aiposs).  Then  f  is  satisfied  in  a  structure  (IT,  a,  ir)  such  that  \  W\  <  \f\2,  v 
is  a  belief  function  (resp.,  possibility  measure)  whose  corresponding  mass  function 
is  positive  on  at  most  \f  \  subsets  of  IT  and  the  mass  of  each  of  these  \f\  sets  is 
a  rational  number  of  size  0(|/|  ||/||  +  |/|  log(|/|)),  and  ir(w)(p)  =  false  for  every 
world  w  £  W  and  every  primitive  proposition  p  not  appearing  in  f. 

Proof.  See  Appendix  A. 4.  □ 

Theorems  6.1  and  6.2  yield  the  following  complexity  result  for  the  decision 
problem  for  CE . 

Theorem  6.3.  The  problem  of  deciding  whether  a  formida  in  CE  is  satisfiable 
in  Mprob  (resp.,  Mlp ,  Mbel ,  Mposs)  is  NP-complete. 

PROOF.  See  Appendix  A. 4.  □ 

7.  REASONING  ABOUT  GAMBLE  INEQUALITIES 

Ineq  presumes  an  oracle  for  all  valid  formulas  about  linear  inequalities;  as  we 
said  earlier,  this  oracle  can  be  replaced  by  the  complete  axiomatization  of  linear 
inequalities  provided  in  FHM.  Similarly,  E5  assumes  an  oracle  for  valid  formulas 
about  gamble  inequalities.  In  this  section,  we  provide  an  axiomatization  that  can 
replace  that  oracle.  One  of  the  axioms  involves  reasoning  about  linear  inequalities 
over  real-valued  functions,  so  we  axiomatize  this  as  well. 

Let  C9  consist  of  all  Boolean  combinations  of  gamble  inequalities  7  >  c,  where 
7  is  a  propositional  gamble,  as  defined  in  Section  3,  and  c  is  an  integer.  As  in 
Section  3.1,  we  write  71  <  72  as  an  abbreviation  for  71—72  <  0,  which  is  the 
form  of  gamble  inequality  used  in  axiom  E5.  We  also  use  the  abbreviations  we 
defined  in  Section  3.1  for  <,  <,  and  =.  However,  we  now  take  71  >  72  to  be  an 
abbreviation  for  71  >  72  A  ->(71  <  72).  The  analogue  of  the  conjunct  71  >  72  is 
not  necessary  when  reasoning  about  likelihood  or  expectation,  since  likelihood  and 
expectation  terms  are  interpreted  as  real  numbers,  and  thus  are  totally  ordered. 
(For  real  numbers  b\  and  &25  -,(&i  <  62)  implies  b\  >  62)-  However,  this  is  not  the 
case  for  gamble  expressions,  which  are  interpreted  as  real- valued  functions. 

We  can  provide  a  semantics  for  gamble  formulas  by  considering  structures  M  = 
(IT,  7r)  where  IT  is  a  nonempty  set  of  worlds  and  tt  associates  with  each  world 
in  IT  a  truth  assignment  on  the  primitive  propositions.  Let  A49  be  the  class  all 
such  structures.  (Clearly,  every  structure  in  Aiprob,  A4lp,  A4bel,  and  A4poss  can  be 
interpreted  as  a  structure  in  M.9  by  simply  “forgetting”  the  uncertainty  measure 
over  the  worlds.  Note  that  IT  is  nonempty  for  such  structures,  since  p(W)  ^  /x(0) 
for  all  the  measures  of  uncertainty  considered.)  Then 

M|=7>c  iff  for  all  w  £  IT,  {|7|}m(^)  >  c. 

Again,  Boolean  combinations  are  given  semantics  in  the  obvious  way. 

We  can  characterize  gamble  formulas  axiomatically  as  follows.  As  before,  we 
have  Taut  and  MP  (although  now  we  consider  the  instances  of  valid  propositional 
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tautologies  in  the  language  C9).  Instead  of  Ineq,  we  have  a  similar  axiom  that 
captures  reasoning  about  linear  inequalities  interpreted  over  real-valued,  functions 
with  nonempty  domains: 

IneqF.  All  instances  in  C9  of  valid  formulas  about  linear  inequalities  over  real¬ 
valued  functions  with  nonempty  domains. 

A  formula  about  linear  inequalities  over  real-valued  functions  is  a  Boolean  combi¬ 
nation  of  formulas  of  the  form  a±Vi  +  •  •  •  anvn  >  c,  where  Vi, . . .  ,vn  are  variables 
ranging  over  real- valued  functions.  This  formula  is  valid  if,  for  every  domain  X 
and  every  assignment  for  real- valued  functions  with  domain  X  to  v\, . ..  ,vn,  the 
resulting  inequality  holds  when  c  is  interpreted  as  the  constant  function  with  domain 
X  that  always  returns  c  €  ffi.  and  >  is  the  pointwise  ordering  on  functions.  To 
get  an  instance  of  IneqF,  we  replace  each  function  variable  Vi  that  occurs  in  a 
valid  formula  about  linear  inequalities  by  a  propositional  formula  ipi.  (Again,  each 
occurence  of  the  function  variable  Vi  must  be  replaced  by  the  same  propositional 
formula  ipi.)  As  with  Ineq,  we  can  replace  IneqF  by  a  sound  and  complete 
axiomatization  for  Boolean  combinations  of  linear  inequalities  over  real-valued 
functions.  We  provide  one  such  axiomatization  at  the  end  of  this  section.10  We  also 
consider  the  following  axioms,  which  capture  properties  of  indicator  functions,  such 
as:  for  any  wG  W,  Xu(w)+Xy(w)  =  Xuuv(w)  if  UdV  =  0,  and  Xu{w)  <  Xy{w) 
if  U  C  V. 

Gl.  a((ip  A  ip)  V  (tp  A  -'V’))  =  a((P  A  if)  +  a(ip  A 

G2.  a(ip  A  ip)  +  b(ip  A  >  0  <t=>  a(ip  A  iff)  >  0  A  b(ip  A  -iip)  >  0 

G3.  true  =  1, 

G4.  ip  —  =  propositional  tautology. 

Intuitively,  Gl  and  G3  say  that  propositional  formulas  act  like  indicator  functions, 
and  G2  says  that  the  >  order  is  the  pointwise  order  on  gambles.  Axiom  G4  simply 
says  that  equivalent  formulas  yield  the  same  indicator  functions.  Let  AX9  be  the 
axiomatization  {Taut,  MP,  IneqF,  Gl,  G2,  G3,  G4}. 

Theorem  7.1.  AX9  is  a  sound  and  complete  axiomatization  of  C9  with  respect 
toM9. 

Proof.  See  Appendix  A. 5.  □ 

Finally,  we  consider  the  complexity  of  the  decision  procedure  for  C9 .  As  we  did 
in  Section  6,  let  L\  be  the  restriction  of  C9  to  inequalities  with  integer  coefficients. 
Perhaps  not  surprisingly,  the  logic  for  reasoning  about  gamble  inequalities  is  NP- 
complete. 

Theorem  7.2.  The  problem  of  deciding  whether  a  formula  of  C f  is  satisfiable 
in  M.9  is  NP-complete. 


1 11  Tn  a  preliminary  version  of  this  paper  [Halpern  and  Pucella  2002b],  we  mistakenly  used  an 
axiomatization  that  relied  on  Ineq.  Ineq  is  inappropriate  for  reasoning  about  linear  inequalities 
over  real-valued  functions  because,  intuitively,  Ineq  captures  properties  of  inequalities  where  >  is 
a  linear  order.  However,  the  pointwise  ordering  on  functions  is  only  a  partial  order.  Furthermore, 
we  did  not  have  axioms  G2  and  G3  in  that  version  of  the  paper;  they  seem  to  be  necessary. 
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Proof.  See  Appendix  A. 5.  □ 

We  now  provide  a  sound  and  complete  axiomatization  for  reasoning  about  linear 
inequalities  over  real- valued  functions.  As  before,  start  with  Taut  and  MP,  and 
consider  the  following  axioms: 


Fl. 

v  —  v  >  0, 

F2. 

{aivi  +  •  • 

•  +  akvk 

>  c)  <t=>  {a\V\  +  •  • 

■  +  akvk  +  Oufc+i 

>c), 

F3. 

(ayci  +  •  • 

■  +  akvk 

>  c)  (aj1Xj1 

+  "  ‘  +  ajk  Vjk  ^ 

c),  if  j\ 

permutation  of  1, . 

■  ■ ,  k, 

F4. 

{aivi  +  ■  ■ 

■  +  akvk 

>  c)  A  (a'pv i  +  •  •  • 

+  a'kvk  >  c') 

=>  (fli  +  a 

■\)vi  +  ' ' 

•  +  ( ak  +  a'k)vk  > 

(c+  0, 

F5. 

(aiv i  +  •  • 

•  +  akvk 

>  c)  <t=>  (daiVi  + 

•  •  •  +  dakvk  >  dc). 

o' 

A 

F6. 

(aiui  +  •  • 

■  +  akvk 

>  c)  (aivi  +  ■  ■ 

■  +  akvk  >  d),  if 

c>  d. 

The  axiomatization  for  Ineq  for  reasoning  about  linear  inequalities  over  reals  pre¬ 
sented  in  FHM  is  identical  to  this  axiomatization,  except  that  it  includes  one 
additional  axiom:  x  >  c  V  x  <  c.  (Note  that  now  c  represents  a  real  number, 
as  opposed  to  c,  which  represents  a  constant  real-valued  function.)  The  absence  of 
this  axiom  is  not  surprising;  although  >  is  a  total  order  over  the  reals,  it  is  only  a 
partial  order  over  real-valued  functions. 

Let  AyJ  be  the  axiomatization  {Taut,  MP,  FI,  F2,  F3,  F4,  F5,  F6}. 

Theorem  7.3.  AX-^  is  sound  and  complete  for  reasoning  about  formulas  about 
linear  inequalities  over  real-valued  functions  with  nonempty  domain. 

Proof.  See  Appendix  A. 5.  □ 

We  can  now  replace  axiom  IneqF  in  AX9  by  FI  F6  (since  AX9  already  has 
Taut  and  MP).  Following  the  discussion  above,  this  means  that  we  replace  the  u’s 
appearing  in  FI  -F6  by  propositional  formulas  (p’s.  Note  that  axiom  FI  becomes 
redundant  in  AX9,  since  it  becomes  false  >  false ,  which  follows  from  G2. 

The  complexity  of  reasoning  about  linear  inequalities  over  real-valued  functions 
(with  integer  coefficients,  following  what  was  said  in  Section  6)  is  NP-complete, 
just  like  reasoning  about  linear  inequalities  over  the  reals. 

Theorem  7.4.  The  problem  of  deciding  whether  a  formula  about  linear  inequali¬ 
ties  (with  integer  coefficients)  is  satisfiable  over  real-valued  functions  with  nonempty 
domain  is  NP-complete. 

Proof.  See  Appendix  A. 5.  □ 

8.  CONCLUSION 

The  notion  of  expectation  is  critical  in  many  areas,  ranging  from  physics  to  decision 
theory  (where  much  of  modern  theory  of  decision  making  under  risk  is  based  on 
the  notion  of  maximizing  expected  utility  [Savage  1954]),  and  theoretical  computer 
science  (where  it  arises,  for  example,  when  establishing  the  correctness  and  effi¬ 
ciency  of  randomized  algorithms  [Motwani  and  Raghavan  1995]).  For  the  most 
part,  expectation  has  been  considered  in  the  context  of  probability.  However,  it 
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has  been  considered  for  other  representations  of  uncertainty.  For  example,  various 
notions  of  decision  making  are  based  on  taking  expectations  with  respect  to  other 
representations  of  uncertainty  [Schmeidler  1986;  Walley  1991].  Indeed,  it  is  possible 
to  consider  almost  all  decision  rules  as  instances  of  a  generalized  expected  utility, 
for  different  representations  of  uncertainty  [Chu  and  Halpern  2003;  2004]. 

After  reviewing  characterizations  of  expectation  functions  with  respect  to  various 
notions  of  uncertainty  (and,  in  a  few  cases,  providing  characterizations  when  none 
existed) ,  we  considered  a  propositional  logic  for  reasoning  about  uncertainty.  Such 
a  logic  should  prove  useful  to  reason  about  decision  making  with  respect  to  various 
notions  of  uncertainty.  Our  logic  is  at  least  as  expressive  as  the  corresponding 
logic  for  reasoning  about  uncertainty  for  all  representations  we  considered,  and 
in  some  cases  it  is  more  expressive.  For  each  representation  of  uncertainty,  we 
provided  a  sound  and  complete  axiomatization  for  the  logic,  and  showed  that  the 
satisfiability  problem  is  NP-complete,  as  it  is  for  reasoning  about  probabilibity, 
lower  probabilities,  and  belief  functions.  Thus,  the  added  expressiveness  of  being 
able  to  reason  about  expectation  of  sets  of  probability  measures  comes  at  no 
computational-complexity  cost.  Moreover,  the  axiomatization  is,  in  some  cases, 
much  more  elegant. 


A.  PROOFS 

A.l  Proofs  for  Section  2 

Proposition  2.6  defines  the  expectation  of  X  in  terms  of  the  values  {x\, . . . ,  xn}  that 
make  up  V(X).  The  following  lemma,  which  turns  out  to  be  useful  in  a  number 
of  technical  results,  shows  that  we  can  use  the  same  calculation  for  expectation  for 
any  set  of  values  that  includes  V(A).  The  lemma  holds  for  all  the  representations 
of  uncertainty  v  considered  in  this  paper.  It  uses  only  the  fact  that  v(W)  =  1  and 
rz(0)  =  0  for  all  representations  that  we  are  considering. 

Lemma  A.l.  Let  X  be  a  gamble,  let  s\  <...<  sm  be  reals  such  that  V(X)  C 
{si, . . . ,  sm},  and  let  v  be  either  a  probability  measure,  belief  function,  or  possibility 
measure.  Then  EV(X)  =  si  +  (s2  —  s{)v(X  >  Si)  +  •  •  •  +  ( sm  —  sm-\)v(X  >  sm_i). 

PROOF.  Clearly,  it  suffices  to  show  that  the  result  holds  for  values  such  that  si  < 
. . .  <  sm.  Indeed,  if  Sj  =  Sj+i  for  some  i,  then  clearly  the  term  (s*+i  —  s,)^(A  >  sf) 
does  not  contribute  to  the  sum.  For  a  set  S  =  {si, . . .  ,  sm}  such  that  S  D  V(A) 
and  si  <  . . .  <  sm,  define 

E^(X)  =  Si  +  (S2  —  si)v(X  >  Si)  +  •  •  •  +  (sm  —  sm_i)iy(X  >  sm_i). 

We  proceed  by  induction  on  |S— V(X)|.  If  |S— V(A)|  =  0,  then  S  =  V(X).  Observe 
that  EV(X)  is  just  E^X\x),  so  the  base  case  is  immediate.  For  the  inductive  step, 
suppose  that  S  D  V(X),  \S—  V(X)|  =  k+l,  and  the  claim  holds  for  all  sets  S'  such 
that  S'  D  V{X)  and  IS"  —  V(X)|  =  k.  Choose  s  €  S  —  V(X)  and  let  S'  =  S  —  {s}. 
We  show  that  E^{X)  =  E^  (A).  There  are  three  cases. 
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(1)  s  =  min(S'):  Since  s  £  V(X),  we  must  have  (X  >  s)  =  W.  Thus, 

E?(X) 

=  s  +  (si  —  s)v(X  >  s)  +  (s2  -  Si)i/(X  >  Si)  H - b  (sn  -  sn-i)v(X  >  sn_i) 

=  s  +  (si  -  s)  +  (s2  -  S!)is(X  >  Si)  H - b  (sn  —  sn- i)v{x  >  sn_i) 

=  Si  +  (s2  —  Si)is(X  >  Si)  +  •  •  •  +  (s„  —  sn~ i)v{X  >  s„_i) 

=  E?(X). 

(2)  s  =  max(S').  Let  sn  =  max(S').  Since  s  ^  V(X),  (X  >  sn )  =  0.  Thus, 

ESAX) 

=  Si  +  (s2  -  Si)v(X  >  Si)  H - b  (s„  -  sn- i)v(x  >  s„_i)  +  (s  -  sn)v(X  >  s, 

=  Si  +  (s2  -  Si)v{X  >  Si)  H - b  (s„  -  Sn-i)u(X  >  Sn- 1) 

=  ESV\X). 

(3)  S  =  {si, . . . ,  Sfe,  s,  Sfc+i, . . . ,  s„}  for  some  si, . . . ,  sn,  such  that  S\  <  . . .  <  Sk  < 
s  <  Sfc+i  <  . . .  <  sn-  Since  s  ^  V(X)  and  s  >  Sk,  we  have  ( X  >  s)  =  ( X  >  Sk )• 
Thus, 

(sk+i  -  sk)n{X  >  sk)  =  (sfc+i  -  s)n(X  >  sk)  +  (s  -  sk)n{X  >  sk) 

=  (sk+i  -  s)fj,(X  >  s)  +  (s  -  sk)n{X  >  Sfc). 

It  is  immediate  that  E^(X)  =  E ^  (X). 

This  completes  the  proof  of  the  inductive  step.  □ 

Lemma  A. 2.  The  functions  E^e \  and,  £piaus  satisfy  (6). 

PROOF.  Suppose  that  X  and  Y  are  comonotonic  gambles.  We  claim  that  there 
exist  pairwise  disjoint  sets  U\,  ...  ,  Un  and  reals  ai, . . . ,  an,  b\, . . . ,  bn  such  that 

(a)  X  =  aiXj/j  +  •  •  •  +  anXu^, 

(b)  1  =  hi  Xjj1  +  •  •  •  +  bnXjjn, 

(c)  a\  <  . . .  <  an,  and 

(d)  h  <  ...<  bn. 

To  see  this,  suppose  that  V(X)  =  {of , ... ,  a'm},  where  a [  <  ...  <  a'm,  and 
V(Y)  =  {b[, . . . ,  6^,},  where  b[  <  . . .  <  b'm>.  Define  U[  =  A_1(a')  for  *  =  1, ... ,  to, 
and  U"  =  y_1(&b)  for  j  =  1, . . . , to'.  Then  clearly  (a)  X  =  a'lAj//  H —  •  +  a'mXu^, 
(b)  Y  =  b^Xu^  +  ■  ■  ■  +  b'm,Xu"  t,  (c)  the  sets  U[, . . . ,  U'm  are  pairwise  disjoint,  (d) 

the  sets  U",...,U!^,  are  pairwise  disjoint,  and  (e)  W  =  U)Ti =  \J1fLlU'i' .  Let 
Vij  =  U[  fl  17".  Note  that  if  Vl3  and  are  both  nonempty  and  i  <  i' ,  then 
j  <  j'-  For  suppose  not;  then  i  <  i'  and  j  >  j1.  Thus,  if  w  €  Vl3  and  w'  G  Vt>j>, 
then  (X(w)  —  X(w'))(Y(w)  —  Y(w'))  =  (a'  —  a',)(6'  —  by)  <  0,  contradicting  the 
comonotonicity  of  X  and  Y .  It  follows  that  we  can  take  the  claimed  sets  U\, . . . ,  Un 
to  be  the  nonempty  sets  Vij  ordered  lexicographically  (so  that  if  Uk  =  Vij,  Uk>  = 
Vi’j’,  and  k  <  k! ,  then  either  i  <  i’  or  i  =  i!  and  j  <  j').  Moreover,  if  Uk  =  Vij, 
take  afc  =  a'  and  bk  =  b) .  It  is  clear  that  these  choices  have  the  required  properties. 

For  this  choice  of  U\ , . . . ,  Un,  it  follows  that  X  +  Y  =  (a1  +  b{)XUl  +  •  •  •  +  ( an  + 
bn)Xun,  with  ai  +  6i  <  ...  <  an  +  bn.  By  construction,  we  have  V(X  +  Y)  = 
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{a\  +  b\, . . . ,  an  +  bn}.  By  Lemma  A.l,  we  have  the  following,  where  v  is  either  Bel 
or  Plaus: 

EV{X  +  Y) 

=  (cti  +  b\)  +  (ct2  +  &2  —  o,\  —  bi)i/(_X  +  Y  >  cii  +  61)  +  •  •  •  + 

( on  +  bn  —  an- 1  —  bn-i)is(X  +  Y  >  an-\  +  bn- 1) 

=  (cti  +  &i)  +  (ct2  +  &2  —  0\  —  b\)v(U2  U  . . .  U  Un)  +  •  •  •  + 

(rtn  T  bn  on—i  6n_i)t^(17n) 

=  0\  +  (a 2  —  a\)v{U2  U  . . .  U  Un)  +  •  •  •  +  (an  —  an-i)v{Un)-\- 
6i  +  (62  —  b\)v{U2  U...U  Un)  +  •  •  •  +  ( bn  —  bn-i)v(Un) 

=  a\  +  (a2  —  ai)z/(X  >  ai)  +  •  •  •  +  ( an  —  an—i)n(X  >  a„_  1)+ 
bi  +  (62  -  6i)i/(y  >  &i)  H - h  0„  -  6„_i)j/(y  >  6n_i) 

=  EV(X)  +  EV(Y), 

where  the  last  equality  follows  from  Lemma  A.l  and  the  fact  that  V(X)  =  {cti,  • . . ,  a„} 
and  V(Y)  =  {bi, ,  bn}.  □ 

Proposition  2.8.  The  function  E-qb \  is  superadditive,  positively  affinely  homo¬ 
geneous,  monotone,  and  satisfies  (5)  and  (6). 

PROOF.  The  fact  that  E-qb \  is  superadditive,  positively  affinely  homogeneous, 
and  monotone  follows  immediately  from  Theorem  2.5  and  Proposition  2.3.  The 
fact  that  -Enel  satisfies  (5)  follows  essentially  from  property  B3  of  belief  functions 
and  Proposition  2.6.  First,  it  is  easily  checked  that  for  gambles  X  and  Y,  X  V  Y  > 
x  =  (X  >  x)  U  (Y  >  x)  and  X  A  Y  >  x  =  (X  >  x)  fl  (Y  >  x).  Consider  the  gamble 
Xi  V. . .  V  Xn.  Let  S  =  V(Ai)U. .  .UV(Xn)  =  {si, . . . ,  sm},  with  si  <  . . .  <  sm.  Let 
so  be  an  arbitrary  real  less  than  every  number  in  S.  Clearly,  V(Xi  V  ...  V  Xn)  C  S. 
Moreover,  for  every  subset  I  C  {1, . . ,  ,n},  V(A*e/Xj)  C  S.  By  Proposition  2.6  and 
Lemma  A.l,  we  have: 

Enel (X\  V  ...  V  Xn) 

=  Si  +  E/~i (sk  —  Sfc-i)Bel(Ai  V  ...  V  Xn  >  Sk- 1) 

=  siBel(Ai  V  ...  V  Xn  >  so)  +  Efc=i(sfc  —  Sfc-i)Bel(Ai  V  ...  V  Xn  >  Sk- 1) 

=  siBel(Ai  >  So  U  . . .  U  Xn  t>  so)T 

E!T=i(sfc  -  Sfe_i)Bel(Xi  >  sfc-i  U  . . .  U  Xn  >  sfc_i) 

^  si  EEi  Z)/c{i,...,n},|7|=i(_1)i+1Bel(nje/A:,'  >  s0)+ 

E/c=i(sfc  ~  Sfc-i)  E»=ri  E/c{i,...,ra},|i|=i(~l)i+1Bel(n,,e/X)-  >  Sfc-i) 

=  E”=iEzc{i,...,n},m=i(-i)t+1(«iBei(nj£/xJ.  >  s0)+ 

EfcLi(sfc  —  sfe-i)Bel(rij6/Xj  >  sfc_i)) 

=  Ei=iEic{i,..,n},|/|=j('1)i+1(*i  +  Eic=i(Sfc  —  Sfe_i)Bel(Aj6/AJ  >  Sfc_i)) 

=  Ef=l  E/C{l,...,ra},|/|=i(—  l)t+1ABel(Aj£/AJ). 

Finally,  the  fact  that  Ese  1  satisfies  (6)  follows  from  Lemma  A. 2.  □ 

The  following  property  turns  out  to  be  useful  in  various  proofs  involving  expec¬ 
tation  for  belief  functions. 

Lemma  A. 3.  If  E  is  an  expectation  function  that  satisfies  (6)  and  positive  affine 
homogeneity,  then  it  satisfies  the  following  property  on  indicator  functions: 

If  U\  f  U2  ft  •  •  •  ft  Un  and  cti,  ■  •  • ,  on  A  0,  /g\ 

then  E(aiXjj1  +  •  •  •  +  anXun)  =  aiE^Xjj^  +  •  •  •  +  anE(Xun) . 
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PROOF.  Define  Sk  =  d\Xu1  +  •  •  •  +  dkXuk,  for  k  =  1 ,n.  Since  cq  >  0  for 
i  =  1, . . . ,  n,  it  is  not  hard  to  show  that  Sk  and  dk+iXjjk  are  comonotonic  for  all 
k.  For  if  Sk(w )  >  Sk{w'),  since  U\  D  . . .  D  Uk,  there  must  be  some  j  <  k  such  that 
w  €  Uj  and  w'  ^  Uj.  Since  Uk  2  £4+ i,  it  must  be  the  case  that  w'  ^  Uk+i-  Hence 
a,k+iXuk+1  («/)  =  0  and  ak+\Xjjk  (uf)  >  0.  Thus,  we  have  comonotonicity.  Since 
E  satisfies  (6),  it  follows  that 

E{a\Xjj1  +  •  •  •  +  anXu n) 

=  E{Sn)  =  E(Sn-y  +  anXUn)  =  EiSn-j.)  +  E(anXUn)  =  ... 

=  E^aiXjj^)  +  •  •  •  +  E(anXun) 

The  result  is  now  immediate,  since  E  satisfies  positive  homogeneity.  □ 

Theorem  2.9.  Suppose  that  E  is  an  expectation  function  that  is  positively  affinely 
homogeneous,  monotone,  and  satisfies  (5)  and  (6).  Then  there  is  a  (necessarily 
unique)  belief  function  Bel  such  that  E  =  Epe i. 

PROOF.  Define  Bel(f7)  =  E(Xjj).  Just  as  in  the  case  of  probability,  it  follows 
from  positive  affine  homogeneity  and  monotonicity  that  Bel(0)  =  0,  Bel(VF)  =  1, 
and  0  <  Bel(f7)  <  1  for  all  U  C  W.  By  (5)  (specialized  to  indicator  functions),  it 
follows  that  Bel  satisfies  B3.  Thus,  Bel  is  a  belief  function.  Now  if  X  is  a  gamble 
such  that  V(X)  =  {x\, . . .  ,xn}  and  X\  <  X2  <  ■  ■  ■  <  xn,  then  it  is  easy  to  check 
that 

X  —  X\\w  T  (X2  X]fXx>xi  *  ‘  ‘  T  ( Xn  Xn—  1  ^Xx^Xn— 1  • 

Clearly  W  D  (X  >  xf)  D  . . .  D  (X  >  x„_i).  Thus,  by  Lemma  A. 3, 

E(X)  =  x\ E(X\y)  +  (X2  —  x\)E(Xx>Xl )  +  •  •  •  +  ( xn  —  xn-i)E(Xx>xn~i) 

=  xi  +  (x2  —  xi)Bel(X  >  x\)  +  ■  ■  ■  +  (. xn  —  x„_i)Bel(X  >  xn_i) 

=  ^Bel(A). 

For  uniqueness,  observe  that  if  Ebbi  =  EBey,  then  Bel(t/)  =  EBei(Xjj)  = 
EBev(Xu)  =  Bel' (U)  for  all  UCW.  □ 

Proposition  2.12.  The  function  Eposs  is  positively  affinely  homogeneous,  mono¬ 
tone,  and  satisfies  (6)  and  (7). 

PROOF.  Recall  from  Section  2.4  that  a  possibility  measure  is  just  a  plausibil¬ 
ity  function.  Therefore,  by  Theorem  2.5  and  Proposition  2.7,  we  have  Eposs  = 
E-pBel,  where  Bel  is  the  belief  function  whose  corresponding  plausibility  function 
is  Poss.  By  Proposition  2.3,  we  immediately  have  that  Eposs  is  positively  affinely 
homogeneous,  and  monotone.  By  Lemma  A. 2,  we  have  that  Eposs  satisfies  (6). 
Showing  that  Eposs  satsifies  (7)  is  straightforward:  Eposs(XUi  uf)  =  Poss(li;  Uf)  = 
max,;  Poss(f7i)  =  max^  Eposs ( X\ji ) .  □ 

Theorem  2.13.  Suppose  that  E  is  an  expectation  function  that  is  positively 
affinely  homogeneous,  monotone,  and  satisfies  (6)  and  (7).  Then  there  is  a  (neces¬ 
sarily  unique)  possibility  measure  Poss  such  that  E  =  Eposs. 

PROOF.  Define  Poss(f7)  =  E(Xjj)-  just  as  in  the  case  of  probability  and  be¬ 
lief  functions,  it  follows  from  positive  affine  homogeneity  and  monotonicity  that 
Poss(0)  =  0,  Poss(kF)  =  1,  and  0  <  Poss  (U)  <  1  for  all  UCW.  By  (7), 
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it  follows  that  Poss  satisfies  Poss3.  Thus,  Poss  is  a  possibility  measure.  The 
proof  that  E  =  Eposa  is  the  same  as  that  of  Theorem  2.9,  which  is  not  surprising 
since  Poss  is  a  plausibility  function.  More  precisely,  let  X  be  a  gamble  such  that 
V(X)  =  {x\, . . .  ,xn}  with  xi  <  . . .  <  xni  and  write  X  as  X\X\y  +  (x2~  X\)Xx>Xl  + 
■■■  +  ( xn  —  xn_  i)Xx>Xn_1.  Since  W  I)  (X  >  X\)  D  . . .  D  (X  >  x„_i),  we  can 
apply  Lemma  A. 3  to  get 

E(X)  =  x\E(Xw)  +  ( X2  —  x\)E(Xx>xi)  +  •  •  •  +  ( xn  —  xn-i)E(Xx>x„-i) 

=  X\  +  (x2  —  aq)Poss(X  >  x\)  +  •  •  •  +  (xn  —  a:n_i)Poss(A  >  xn_i) 

=  EPoss(X). 

□ 

A. 2  Proofs  for  Section  4 

The  following  transformations  on  formulas  of  CE  will  be  used  in  the  proofs  of 
Theorems  4.1,  5.1,  5.3,  and  5.4.  We  prove  here  that  these  transformations  preserve 
satisfiability  of  the  formulas,  with  respect  to  the  appropriate  structures. 

First,  define  for  a  formula  /  of  CE,  the  transformation  fTl  inductively  on  the 
structure  of  /,  taking  +  ■  +  ane(jn)  >  b)Tl  to  be  t\  +  -  ■  ■+tn  >  b,  where  t,  is 

obtained  from  a,;  and  H - Ck,HPk,i  as  aici)ie(<piij)  H - h  a iCktie(ipk^). 

We  define  (/i  A  f2)Tl  and  (^/i)Tl  as  fEl  A  /J1  and  — > ( ) ,  respectively. 

Lemma  A. 4.  If  M  £  Xivrob ,  then  M  \=  f  if  and  only  if  M  ^  fTl . 

PROOF.  We  proceed  by  induction  on  the  structure  of  /.  For  the  base  case, 

M  |=  aie(7i)  +  •••>& 
iff  ai£'M(A7l)  +  •  •  ■  >  6 

iff  a1E/Ji(c1AX^lpi  ljM  H - h  cyX[W  l jM)  H - >b 

iff  aiCi!i£,M(A[¥,ia]M)  H - h  a^Ck^E^X^^^)  H - >b 

iff  M  1=  0101,10(^1,1)  H - 1-  aiCfc,ie((pfc,i)  H - >  b. 

The  inductive  cases  are  immediate.  □ 

The  second  transformation  is  a  bit  more  complicated.  As  before,  we  define  a 
transformation  taking  a  formula  /  of  CE  to  a  formula  fT2  by  induction  on  the 
structure  of  /.  Intuitively,  we  translate  every  expectation  term  e(y)  appearing 
in  /  into  an  expectation  term  of  the  form  given  by  Proposition  2.6,  namely  do  + 
(di  —  do)e(V’i)  +  •  •  •  +  (dm  —  dm_i)e('0m)  for  formulas  ipi, ipm.  As  before,  take 
(/1  A  /2)T2  and  (^/i)T2  to  be  /f2  A  / J2  and  ~‘(fi2),  respectively.  Take  (aie(7i)  + 
•  •  •  +  ane( 7„)  >  b)T 2  to  be  t\  +  •  •  •  +  tn  >  b ,  where  t,  is  obtained  from  at  and 
7 i  =  Ci,j</?i,i  +  •  •  •  +  Ck,i<fik,i  as  follows.  Let  pi,  ■  ■  ■  ,Pn  be  the  primitive  propositions 
that  appear  in  /.  Let  an  atom  over  Pi,...,Pn  be  a  formula  of  the  form  qi  A 
...  A  qx,  where  qi  is  either  pi  or  —>Pi .  There  are  clearly  2N  atoms  over  p\, . . .  ,px- 
Let  5 i,...,(52jv  be  an  arbitrary  ordering  of  these  atoms.  It  is  easy  to  see  that 
atoms  are  pairwise  disjoint.  It  is  also  easy  to  see  that  any  formula  over  pir. . .  ,pn 
can  be  written  in  a  unique  way  as  a  disjunction  of  atoms.  Using  these  atoms, 
we  construct  a  gamble  7'  equivalent  to  7*  as  follows.  For  j  £  {l,...,2jV},  let 
cj  =  E{1  :  Sj  VI„  is  a  prop,  tautology}  CU-  Tt  is  straightforward  to  check  that  7i  = 
bet  do,...,dm  be  the  distinct  elements  of  { } yc { 1, _ 2 v } ,  with  do  < 
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...  <  dm-  For  j  G  {1, . . . ,  to},  let  ipj  =  V;e{  i,...,2w},ci>dJ  Note  tliat  V’o  is 
logically  equivalent  to  true ;  moreover,  f/’j+i  =>  77  is  a  propositional  tautology  for 
all  j  G  {0, . . . ,  m—  1}.  Finally,  let  7'  =  do  +  (d\  —  d0)ipi  +  -  ■  ■  +  (dm  —  dm-i)ipm.  One 
can  check  that  7 j  and  7'  are  equivalent  gambles.  Indeed,  7^  is  provably  equivalent 

to  d0{Yji=i  Si)  +  (d\  -  ^o)(Sci>di  Si)  A  ■  ■  ■  +  (dm  ~  dm-i)(J2cl>dm  Si).  Distributing 
the  coefficients  and  putting  like  terms  together,  we  see  that  the  coefficient  of  Si 
is  just  do  A  (d\  —  do)  A  . . .  +  (drt  —  drt- 1)  =  dre,  where  re  =  max{r  :  c;  >  dr}. 
By  definition  of  d\, . . . ,  drn ,  dre  =  Ci,  and  therefore  7 ,  and  7'  are  equivalent.  Note 
that,  by  Lemma  A. 3,  if  E  is  an  expectation  function  that  satisfies  comonotonicity 
and  positive  homogeneity,  then  E(Xy)  =  d\  A  {d\  —  d0)E(X^1jM)  +  •  •  •  +  ( dm  — 
dm-i)E(Xy,rnjM).  Let  ti  be  ciido  A  Qi(d\  do)e{^fi)  A  *  *  *  A  Ui(dm  dm_i)e(^m). 

Lemma  A.  5.  If  M  G  MprobUMbelUMposs ,  then  M  \=  f  if  and  only  if  M  \=  /TA 

PROOF.  We  proceed  by  induction  on  the  structure  of  /,  for  M  G  A4bel\  the  result 
follows  for  structures  in  JV[prob  and  A4poss,  since  these  can  be  viewed  as  structures 
in  A4bel.  For  the  base  case,  we  have 

M  |=  aie(7i)  H - ane( 7n)  >  b 

iff  d\ E~qq\ )  +  •  •  •  driE'BQi (^X^n )  ^  b 
iff  ci\ E~qq\ )  +  •  •  •  +  dnE~QG ^  b 

iff  ai^Bei(^o,i  +  (rfi,i  —  ^o,i)^[-01;1jM  H - l>l)^['0m1,l  ]m  )  + 

A  anF/Bel(do,n  A  (^l,n  A  *  *  *  A 

(dmn,n  dmn  —  l,n)^['0mn  ^  ^ 

iff  aido.i  +  cii —  ^o,i)A,Bei(A[^,ia]M)  +  •  •  •  + 

0-1  (dm\,l  dmi  — 1,1  )F/Bel( ,i]m  )  A  *  '  '  A 

«n<io,n  +  ai(dl,n  —  ^0,n)F'Bel(^[i/)n,i]M)  +  '  '  '  + 

Q-n(dmn,n  dmn  —  l,n)  Abel  (A  fi/jmn  n]M  )  A  S 
iff  M  |=  aido.i  +  ai(di,i  —  do,i)e(V’i,i)  A  •  •  •  A  ai(dm,i  —  dm-i,i)e(Am,i)  A  •  •  •  A 
A^O.n  A  an)di  n  doin)^(V?l,n)  A  Q-n(dm,n  dm—  l,n)^(Am,n)  A  S. 

The  fact  that  we  can  distribute  the  expectation  -Enel  of  the  gamble  into  a  sum  of 
expectation  of  indicator  functions  follows  from  comonotonicity,  using  Lemma  A. 3. 

The  inductive  cases  are  immediate.  □ 

Theorem  4.1.  CE  and  CQU  are  equivalent  in  expressive  power  with  respect  to 
Mprob ,  Mbel ,  and  Mposs .  CE  is  strictly  more  expressive  than  CPU  with  respect  to 
Mlp. 

PROOF.  The  proof  follows  the  lines  laid  out  in  Section  4.  First,  we  show  that 
CE  is  at  least  as  expressive  as  C9U  with  respect  to  Mprob,  Mbel,  Mlp,  and  Mposs. 
Formally,  we  show  that  every  formula  /  of  C®u  is  equivalent  to  the  formula  fT  G  CE 
that  results  by  replacing  I(ip)  by  e{ip).  Define  fT  by  induction  on  the  structure 
of  /,  taking  (aii(ipi)  A  •  •  •  A  «„%„)  >  b)T  to  be  aie(^i)  A  •  •  •  A  an£(ipn)  A  6, 
(/1  A  f2)T  to  be  /f  A  /J,  and  (->/i)T  to  be  ^(/T). 

It  suffices  to  show  that  for  all  M  in  A4prob,  Mbel,  A4lp,  or  A4poss,  we  have  M  |=  / 
if  and  only  if  M  |=  fT .  First,  note  if  v  is  a  probability  measure,  belief  function, 
or  set  of  probability  measures,  then  Eu(Xu)  =  v(U),  where  Xv  is  the  indicator 
function  of  U.  Let  M  be  an  arbitrary  structure  in  A4prob,  A4bef  Ailp,  or  A4poss, 
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with  associated  measure  of  uncertainty  p.  Thus,  if  v  is  the  measure  associated 
with  structure  M,  we  have  that  i/([^]m)  =  EV(\X^M\ }m)-  (If  v  is  the  set  V  or 
probability  measures,  we  take  Ev  =  Ep.)  The  result  now  follows  immediately  by  a 
straightforward  induction  on  the  structure  of  /. 

We  next  show  that  CPU  is  as  expressive  as  CE  with  respect  to  Mprob ,  M.bel, 
and  Mposs.  Let  CE  be  the  sublanguage  of  CE  where  the  expectation  operator  e 
is  applied  only  to  propositional  formulas,  as  opposed  to  arbitrary  gambles.  It  is 
immediate  from  the  construction  in  the  previous  paragraph  that  if  /  £  £®u ,  then 
fT  £  CE  .  Moreover,  it  is  easy  to  see  that  every  formula  /'  £  CE  is  of  the  form  fT 
(where  /  is  the  result  of  replacing  all  occurrences  of  e(ip)  in  f  by  £(<^)).  Since  we 
showed  above  that  /  is  equivalent  to  fT,  to  prove  that  CQU  is  as  expressive  to  CE 
with  respect  to  A4prob,  Xibel,  and  Aiposs,  it  suffices  to  show  that  every  formula  in 
CE  is  equivalent  to  a  formula  in  CE'  in  structures  in  Xtprob  U  A4bel  U  Xiposs .  But 
this  is  immediate  from  Lemma  A. 5,  since  the  formula  fT2  £  CE  . 

Finally,  we  show  that  CE  is  strictly  more  expressive  than  C9U  with  respect 
to  Xilp .  To  establish  this,  it  is  sufficient  to  exhibit  two  structures  in  A4lp  that 
satisfy  the  same  formulas  in  £®u ,  but  can  be  distinguished  by  a  formula  /  in  CE . 
(This  means  that  /  in  CE  cannot  be  equivalent  to  any  formula  in  C®u .)  We  use 
a  variant  of  Example  2.11.  Consider  the  two  Xilp  structures  Mi  =  (W,V i,n) 
and  M2  =  (IF,  P2,  7r),  where  W  =  {uq,  iv2,  1C3},  7r  is  such  that  p  is  true  at  uq, 
both  p  and  q  are  true  at  w2,  and  neither  p  nor  q  is  true  at  W3,  and  the  sets  of 
probability  measures  V\  and  V2  are  given  as  follows.  We  can  describe  a  probability 
measure  on  W  by  a  tuple  (01,02,03),  where  oi  gives  the  probability  at  Define 
Vi  =  {(1/3, 2/3,0),  (0, 1/3, 2/3),  (2/3, 0, 1/3)},  and  V2=ViU  {(1/3, 0,  /2, 3)}.  It 
is  easy  to  check  that  (’Pi)*  and  (V2)*  are  both  0  on  singleton  subsets  of  W  and 
1/3  on  doubleton  subsets.  Hence,  (Pi)*  =  {V2)*-  Therefore,  no  formula  involving 
only  lower  probability  can  distinguish  these  two  structures,  and  Mi  and  M2  satisfy 
the  same  formulas  of  CPU .  Now,  consider  the  gamble  p  +  q.  It  is  easy  to  see 
that  { p  +  q|}mi  =  {]p  +  qfjM2  is  the  random  variable  X  defined  by  X(uq)  =  1, 
X(w2)  =  2,  and  X(ws)  =  0.  It  is  not  hard  to  check  that  EVi{X)  =  2/3,  and 
E-p2(X)  =  1/3.  Hence,  Mi  \=  e(p  +  q)  >  1/2,  and  M2  \=  e(p  +  q)  <  1/2,  so  that 
M2  \=  ~<e(p  +  q)  >  1/2.  □ 

A. 3  Proofs  for  Section  5 

The  proofs  of  Theorems  5. 1-5.4  use  an  approach  similar  to  the  one  taken  in  FHM. 
We  first  need  some  definitions.  We  say  a  formula  cr  is  consistent  with  an  axiom 
system  AX  (or  simply  AX-consistent)  if  is  not  provable  from  AX.  To  show 
that  AX  is  a  complete  axiomatization  with  respect  to  some  class  of  structure  A4, 
we  must  show  that  every  formula  that  is  valid  in  every  structure  in  A4  is  provable  in 
AX.  This  is  equivalent  to  showing  that  every  AX-consistent  formula  0  is  satisfiable 
in  A4. 

The  proofs  of  Theorems  5. 1-5.4  are  all  structured  as  follows.  Soundness  is 
straightforward  in  all  cases.  Completeness  is  obtained  by  showing  that  a  consistent 
formula  /  is  satisfiable  in  the  appropriate  set  of  structures  A4.  More  specifically, 
assume  that  formula  /  is  not  satisfiable  in  a  structure  in  A4;  we  must  show  that 
f  is  inconsistent.  We  first  reduce  /  to  a  canonical  form.  Let  V  ...  V  gr  be 
a  disjunctive  normal  form  expression  for  /  (where  each  gi  is  a  conjunction  of 
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expectation  inequalities  and  their  negations).  Using  propositional  reasoning,  we  can 
show  that  /  is  provably  equivalent  to  this  disjunction.  Since  /  is  unsatisfiable,  each 
gi  must  also  be  unsatisfiable.  Thus,  it  is  sufficient  to  show  that  any  unsatisfiable 
conjunction  of  expectation  inequalities  and  their  negations  is  inconsistent.  Let 
f  be  such  a  formula.  To  show  that  it  is  inconsistent,  we  essentially  construct  a 
system  of  inequalities  /  from  /  by  replacing  every  term  e(%)  in  /  by  a  variable  Xi, 
with  the  property  that  /  is  satisfiable  over  structures  in  A4  if  and  only  if  /  has  a 
solution  over  the  reals.  Since  f  is  unsatisfiable,  f  has  no  solution,  so  that  must 
be  an  instance  of  Ineq.  (That  /  has  no  solution  means  that  /  is  not  satisfiable 
as  a  formula  about  linear  inequalities,  so  that  ->/  is  a  valid  formula  about  linear 
inequalities.)  Therefore,  ->/  is  provable,  and  /  is  inconsistent.  The  details  of  how 
to  construct  /  differ  for  each  representation  of  uncertainty. 

Theorem  5.1.  AX.prob  is  a  sound  and  complete  axiomatization  of  CE  with 
respect  to  Mprob . 

PROOF.  Soundness  is  straightforward.  For  completeness,  we  proceed  as  above. 
Without  loss  of  generality,  assume  that  f  is  a  conjunction  of  expectation  inequalities 
and  their  negations.  Using  axioms  El  and  E2,  we  can  convert  /  into  the  equivalent 
formula  fTl  (Lemma  A. 4)  where  e  is  applied  only  to  propositional  formulas.  For 
every  propositional  formula  p  in  fTl,  p  is  equivalent  to  V^=1 6tj ,  where  <5,;, , . . .  ,5ik 
are  the  atoms  over  the  propositions  in  /  such  that  S^.  =>  p  for  all  1  <  j  <  k. 
Since  -i(<5,  A  5^)  is  a  propositional  tautology  for  all  j  ^  l,  p  =  8^  +  ■  ■  ■  +  Sik  is  a 
valid  formula  about  propositional  gamble  inequalities  (see  Section  7),  and  axiom  E5 
yields  e{p)  =  e(6 ,,  +•••  +  £»*)•  This  means  that  we  can  find  a  formula  /'  provably 
equivalent  to  fTl,  where  f  is  formed  by  replacing  each  term  ae(p )  of  fTl  by  the 
sum  ae(6i1)  +  •  •  •  +  ae(Sik ),  and  then  collecting  like  terms.  Let  f"  be  obtained  from 
/'  by  adding  as  conjuncts  to  f  all  the  expectation  inequality  formulas  e(6j)  >  0, 
for  1  <  j  <  2n ,  e(<5i)  +  •  •  •  +  e((52«)  >  1,  and  —  e{5\)  —  ■  ■  ■  —  e((52«)  >  —1  (which 
together  essentially  say  that  the  sum  of  the  probabilities  of  the  atoms  is  1).  It  is 
not  hard  to  see  that  these  formulas  are  provable,  hence  f"  is  provably  equivalent 
to  /',  and  hence  to  /.  We  therefore  only  have  to  show  that  f"  is  satisfiable. 

The  negation  of  an  expectation  inequality  aie(7i)  +  •  •  •  +  ane{ jn)  >  b  can  be 
written  — aie(7i)  —  •  •  •  —  a„e( 7n)  >  — b .  Thus,  without  loss  of  generality,  we  can 
assume  that  /"  is  the  conjunction  of  the  formulas 

e(di)  +  •  •  •  +  e(S2ff)  A  1 

— e(<5i) - -  e(S2i v)  >  -1 

e(<5i)  >  0 

e(S2 «)  >  0 

ai,ie(6i)  ~ F  *  *  *  — Oi  2n e(52N )  A  b\ 

ar  2Ne(S2N)  A  br 
—  Cq  2W^(^2w)  ^  ^1 


e(<5-|)  +  •  •  • 

-a'i;ie(5i) - 
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-a's,le(<5l) - a's,2Ne(^2N)  >  K- 

Consider  the  following  system  of  inequations,  obtained  by  replacing  e ( <5,: )  by  the 
variable  xp. 

X\  T  *  *  *  T  X2n  A  1 
—  X\  —  ■  ■  ■  —  X2n  >  —1 
Xi  >  0 

X2n  >  0 

O'ljl't'l  T  *  *  *  T  Ctl2N  X2N  ^  bl 

ar>iXi  T  •  •  *  T  ar  2NX2N  ^  br 
ft-|_  \X\  *  *  *  cq  2nX2n  ^ 

— a'spxi  —  •  •  •  —  a's  2N x2n  >  b's. 

Clearly  if  f"  is  satisfiable,  say  in  a  structure  M  with  associated  probability  measure 
/x,  then  the  system  is  satisfiable,  by  taking  Xi  =  Conversely,  if  the  system 

of  inequations  has  a  solution,  then  f"  is  satisfied  in  a  structure  M  with  associated 
probability  measure  fi  such  that  Xi  = 

Returning  to  the  main  argument,  suppose  by  way  of  contradiction,  that  /  is  not 
satisfiable.  Then  this  system  of  inequations  has  no  solution.  It  follows  that  is 
an  instance  of  the  axiom  Ineq.  Since  f"  is  provably  equivalent  to  /,  it  follows  that 
-1/  is  provable,  so  that  /  is  inconsistent,  a  contradiction.  □ 

The  proofs  of  Theorems  5.2,  5.3,  and  5.4  require  some  additional  terminology. 
Let  /  be  a  formula  of  CE,  and  let  pi,. . .  ,pn  be  the  primitive  propositions  that 
appear  in  /.  Observe  that  there  are  22  inequivalent  propositional  formulas  over 
Pi,...,Pn-  The  argument  goes  as  follows.  Recall  the  notion  of  an  atom  over 
Pi, . . .  ,PNi  introduced  before  Lemma  A. 5.  It  is  easy  to  see  that  any  formula  over 
pi, . . .  ,pn  can  be  written  in  a  unique  way  as  a  disjunction  of  atoms.  There  are  22 
such  disjunctions,  so  the  claim  follows.  Let  p\, . . .  ,p22«  be  some  canonical  listing 
of  the  inequivalent  formulas  over  pi, . . .  ,Pn-  Without  loss  of  generality,  we  assume 
that  pi  is  equivalent  to  true,  and  p22N  is  equivalent  to  false.  Following  FHM,  we 
call  these  formulas  pi ,  i  =  1, ...  ,22  regions. 

Theorem  5.2.  AX(p  is  a  sound  and  complete  axiomatization  of  CE  with  respect 
to  Mlp . 

PROOF.  Soundness  is  straightforward.  For  completeness,  we  proceed  as  above. 
Again,  without  loss  of  generality,  assume  that  /  is  a  conjunction  of  expectation 
inequalities  and  their  negations. 


Journal  of  the  ACM,  Vol.  V,  No.  N,  May  2007. 


30 


J.  Y.  Halpern  and  R.  Pucella 


The  first  step  of  the  proof  is  to  find  a  formula  f  provably  equivalent  to  /,  where 
the  gambles  in  /'  are  expressed  in  terms  of  atoms  Si,. ,  52n .  As  observed  above, 
every  propositional  formula  p  in  /  is  equivalent  to  some  region  pi,  1  <  *  <  2Z  , 
which  is  of  the  form  V*L-|  8,. ,  where  Silt . . . ,  Sik  are  the  atoms  over  the  propositions 
in  /  such  that  <5, .  =7  p  for  all  1  <  j  <  k.  Since  A  Sp  <t7  false  is  a  propositional 
tautology  for  all  j  ^  l,  p  =  +•  •  -+Sik  is  valid.  It  easily  follows  that  a  propositional 

gamble  a\p\  +  •  •  •  +  anpn  is  equal  to  a  propositional  gamble  of  the  form  a\  <5-|  +  ■  ■  ■  + 
o!2N82n  .  By  axiom  E5,  e(a\pi  +  •  •  •  +  anpn)  =  e(a'18i  +  •  •  •  +  a'2 nS2n)  is  provable. 
This  means  we  can  find  a  formula  f  provably  equivalent  to  /,  where  each  term  ae( 7) 
of  /  is  replaced  by  a  term  ae(a[S  1  +  •  •  •  +  a'2NS2N).  In  fact,  the  following  arguments 
shows  that,  without  loss  of  generality,  we  can  take  the  a[ s  to  be  nonnegative.  Given 
a  gamble  a^Si  +  . . .  +  a'2N52N,  let  b  =  min1<i<2w (o').  We  can  easily  show  that 
K  +  b)5 1  +  . . .  +  ( a'2N  +  b)62N  —  b  =  a^S  1  +  . . .  +  a'2NS2N  is  a  valid  gamble  equality. 
Thus,  every  expectation  inequality  formula  cie(7i)  +  . . .  +  Cfce( 7*,)  >  d  in  f  is 
provably  equivalent  to  a  formula  of  the  form  Cie(7()  +c\b\  + . . . +  0^6(7' )  +  C;c6;c  >  d, 
which  in  turn  is  provably  equivalent  to  cie(7()  + . . .  +  Ckefy'k)  >  d—Cibi  —  ...  —  Ckbk- 
Thus,  without  loss  of  generality,  we  can  take  the  coefficients  of  the  gambles  in  /' 
to  be  nonnegative. 

The  next  step  of  the  proof  is  to  derive  a  finite  system  of  inequations  /  corre¬ 
sponding  to  f  such  that  f  is  satisfiable  if  and  only  /  has  a  solution.  Suppose  that 
we  have  found  such  a  formula  /  and  that  f  is  unsatisfiable.  Then  /  has  no  solution. 
Thus,  the  formula  —if'  is  an  instance  of  Ineq.  Since  f  is  provably  equivalent  to 
/,  —if  is  provable,  and  thus  /  is  inconsistent,  a  contradiction.  Therefore,  f ,  and 
hence  /,  is  satisfiable.  The  remainder  of  the  proof  consists  of  coming  up  with  /, 
and  showing  that  it  has  a  solution  if  and  only  if  /'  is  satisfiable. 

We  would  like  f  to  be  a  system  of  inequalities  that  yields  a  solution  that  can 
be  used  to  construct  a  lower  expectation  function  that  satisfies  /'.  We  can  force 
a  solution  to  /  to  be  a  lower  expectation  function  by  adding  to  /  inequalities 
corresponding  to  all  the  instances  of  axioms  E6-E8.  Unfortunately,  there  are 
infinitely  many  such  instances.  The  aim  now  is  therefore  to  derive  a  finite  set  of 
instances  of  E6-E8  that  is  sufficient  to  constrain  a  solution  to  /  to  be  a  lower 
expectation  function. 

To  do  this,  let  71, . . .  ,7„  be  the  propositional  gambles  7  such  that  e(7)  appears 
in  /',  together  with  the  propositional  gambles  false  and  true  (if  they  do  not  already 
appear  in  /').  For  ease  of  exposition,  take  7n_i  =  false  and  =  true.  As  we  saw 
earlier,  each  7,  is  provably  equivalent  to  a  formula  of  the  form  ayidi-f  -  •  -+ai2NS2N, 
where  <5-| , . . . ,  52n  are  the  atoms  over  the  primitive  propositions  appearing  in  /,  and 
Ojj  >  0.  We  now  construct,  for  every  propositional  gamble  7*  (1  <  i  <  n  —  1),  a 
finite  set  Bt  of  vectors.  (We  do  not  need  a  vector  for  the  gamble  7n  =  true.)  We 
give  the  construction  of  B\,  and  then  describe  the  minor  modifications  needed  to 
construct  Bi  for  i  =  2, . . .  ,n  —  1.  We  then  show  how  to  use  these  sets  to  identify  a 
finite  set  of  instances  of  E6-E8. 

Let  A\  be  the  (n  —  1)  x  2N  matrix  of  real  numbers  whose  ith  row  consists  of  the 
coefficients  of  <5i, . . .  ,S2n  in  7;+i,  i  =  1, ...  ,n  —  1.  Let  B[  be  the  set  of  vectors 
b  =  (b2, ... ,  bn)  such  that  b2, . . . ,  bn-\  >  0  ( bn  can  be  negative)  and 

bAi  <  (aqi, . . .  ,alj2»).  (9) 
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It  is  easy  to  see  that  B[  is  a  closed  convex  set:  it  is  clearly  closed,  and  if  b-\ ,  b2  €  B[, 
then  so  is  ab1  +  (1  —  a)b2 ,  for  all  a  €  [0, 1].  Thus,  for  each  vector  y  —  (t/i, . . . , 
such  that  2/i., ,  yn-2  >  0,  there  exists  a  by  £  B[  such  that  by-y  is  maximal  (where 
•  is  the  inner  product).  It  is  a  consequence  of  the  Krein-Milman  Theorem  (see 
Rudin  [1991],  for  instance)  that  the  set  of  such  by  is  a  finite  subset  Bi  of  B[. 

We  use  the  set  B\  to  derive  a  finite  number  of  instances  of  E6-E8  as  follows. 
Note  that  if  b  =  (b2, . . . ,  bn)  satisfies  (9),  then  6272  +  •  •  •  +  bn 7„  <  71  is  a  valid 
formula  about  gamble  inequalities.  Therefore,  by  E5,  e(6272  +  •  — b  bn"fn)  <  e(7i). 

By  applying  E6,  E7  and  E8,  we  can  derive  620(72)  H - 6„_ie(7„_i)  +  bn  <  e(7i). 

Let  F?  be  the  conjunction  of  the  instances  of  axioms  E6,  E7,  and  E8  that  are  used 
to  perform  this  derivation.  Let  /1  be  the  conjunction  of  Ft  for  all  b  £  B\. 

This  process  defines  a  set  £>1  of  vectors,  and  from  these  a  formula  /1.  Repeat 
this  process  for  the  gambles  72,  •  •  •  ,7n-i,  by  interchanging  the  role  of  71  and  7 j, 
for  2  <  i  <  n  —  1.  After  doing  this  for  all  gambles,  we  obtain  sets  Si, ... ,  S„_i  of 
vectors,  and  formulas  /1 , . . . ,  fn-i- 

Let  /"  be  the  conjunction  of  /1,  ...,  /„_  1,  /',  e(7„_i)  >  0,  -e(7„_i)  >  0, 
e(7 n)  >  1,  and  —  e(7„)  >  —1  (that  is,  e(false)  =  0  and  e(true )  =  1,  since  7„_i  = 
false  and  7„  =  true,  by  assumption).  Let  /  be  the  conjunction  of  inequalities 
obtained  by  replacing  every  instance  of  a  term  of  the  form  e(y)  in  f"  by  the  variable 
x 7.  Note  that,  besides  e(7i), . . . ,  e(7„),  there  are  other  terms  of  the  form  e(q) 
that  arise  in  f\, ,  fn-i\  the  gambles  7  in  these  terms  are  linear  combinations  of 
7i,  •  •  • ,  7 n-  We  then  obtain  a  system  of  inequalities  over  the  variables  x1.  We  now 
show  that  /  is  our  required  system  of  inequalities,  that  is,  f  is  satisfiable  if  and 
only  if  f  has  a  solution. 

It  is  straightforward  to  show  that  if  /'  is  satisfiable,  then  /  has  a  solution.  If 
/'  is  satisfiable,  then  there  exists  a  lower  probability  structure  such  that 

(W,V,ir)  \=  f ,  and  hence  (W,  V,n)  ^  f"  (since  the  instances  of  E6  -E8  are  valid 
in  lower  probability  structures).  Clearly,  taking  x1  =  E_v({ |7|}m)  gives  a  solution 
to  /. 

The  interesting  direction  is  showing  that  if  /  has  a  solution,  then  /'  is  satisfiable 
in  Ailp.  Suppose  that  f  has  a  solution  in  which  x7l , . . . ,  xln  taken  on  values 
x\, . . . ,  2:* ,  respectively.  (Note  that  by  the  construction  of  /,  we  must  have  a:*_:  =  0 
and  x*  =  1.)  Take  W  =  {<$1, . . . ,  i52n},  and  let  tt (5i)(p)  =  true  if  and  only  if 
5i  =>  p  is  a  propositional  tautology.  We  need  to  show  that  there  exists  a  set  of 
probability  measures  V  such  that  ( W,V,tt )  \=  f.  To  do  this,  we  start  with  the 
solution  to  /,  which  intuitively  gives  us  a  lower  expectation  function  defined  on 
a  subset  of  gambles  (those  that  appear  in  /),  and  show  that  it  can  be  extended 
to  a  lower  expectation  function  defined  on  all  gambles.  This  lower  expectation 
function  will  give  us  the  set  V  of  probability  measures  necessary  for  satisfiability. 
More  precisely,  corresponding  to  the  propositional  gambles  71 , . . . ,  7 „  appearing  in  / 
(along  with  false  and  true,  as  described  above),  let  W  be  the  gamble  corresponding 
to  7 ,  =  a^iS  1  +  . . .  +  ai  2N52N  defined  on  W  by  Xi(Sj)  =  aij,  for  all  1  <  j  <  2N . 
Define  the  function  P*  on  {Xi, . . . ,  Xn}  by  Pf{Xf)  =  x*.  Our  goal  is  to  extend  P* 
to  a  lower  expectation  function  E*  defined  on  all  gambles,  such  that  E*  ( Y )  =  P*(Y) 
for  Y  £  {Xi, . . . ,  Xn}. 
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The  first  thing  we  have  to  check  is  that  P*  is  a  potential  candidate  to  be  a  partial 
lower  expectation  function.  This  is  made  precise  by  Walley’s  [1991,  p.72]  notion  of 
coherence.  A  function  P  defined  on  a  set  {X\, . . .  ,Xn}  of  gambles  is  coherent  if 
and  only  if  for  all  reals  bi, . . . ,  bn  >  0  and  i*  £  {1, . . . ,  ?t},  we  have11 


sup 

w£W 


(52bJ(Xj-P(Xj)))-bi.(Xi. 

1#* 


P(Xi*)) 


>  o. 


(10) 


If  if  is  a  lower  expectation  function  (that  is,  if  E  =  E_v  for  some  set  V  of  probability 
measures)  then  (10)  holds  (with  P  replaced  by  E).  To  see  this,  first  note  that  for 
any  gambles  Y,  Y\, . . . ,  Yn  and  nonnegative  reals  b,  bi, . . . ,  bn,  by  Proposition  2.3, 

E(b(Y  -  my)))  =  0,  and  E(61(F1  -  EfYf))  +  •  •  •  +  E(Yn  -  E{ YJ)  >  0.  Now 
suppose  that 


sup 

w£W 


(E  w-  -  -  bE{y  -  ew 

1= 1 


=  c  <  0. 


Then  £"=i  bAYi  ~  E(Yi))  <  KE(Y  ~  E(Y))  +  c.  Thus 


E(J2  bAYi  -  EiYo)))  <  E(b(Y  -  E(Y))  +  c)  =  E(b(Y  -  E(Y)))  +  c  =  c  <  0. 
i=i 


But  this  is  a  contradiction.  It  follows  that  (10)  holds  for  E. 

This  shows  that  coherence,  that  is,  (10),  is  a  necessary  condition  for  P  to  be 
extendible  to  a  lower  expectation.  Walley’s  Natural  Extension  Theorem ,  which  we 
now  state,  shows  that  it  is  sufficient  as  well. 


Theorem  A. 6.  [Walley  1991,  p.  123]  Suppose  that  P  is  a  coherent  real-valued 
function  defined  on  a  set  Q  of  gambles  on  W.  Define  the  natural  extension  E  of  P 
as 

m 

E(Y)  =  sup{fo  :  Y  -PfYj)),m>0,Yj  &  0,6eM}. 

l=i 

Then  E  is  a  lower  expectation  function  (that  is,  E  =  Ev  for  some  set  V  of 
probability  measures  on  W )  and  E_  agrees  with  P_  on  the  gambles  in  Q . 

It  follows  from  Theorem  A. 6  that  to  show  that  P*  can  be  extended  to  a  lower 
expectation,  it  suffices  to  show  that  it  is  coherent.  This  is  done  in  the  next  lemma. 

Lemma  A. 7.  The  function  P*  is  coherent  on  {A'i, . . . ,  Xn}. 


1 1  Will  ley  has  an  apparently  stronger  requirement,  namely,  that  for  all  Yi , . . . ,  Ym  C  {  X  i , . . . ,  Xn  } 
and  all  reals  bi,.. .  ,bm,  we  have  supwew  |[(XI^=2  bAYj  ~  ~  foi C^T  -  ,P* (Yl ))](«>)}  >  0. 

However,  we  can  assume  that  all  the  Yj’s  are  distinct  without  loss  of  generality  (since  if  there  is 
a  repetition  of  Xj’s,  we  can  simply  add  the  coefficients  bi),  and  if  any  Xi  does  not  appear  among 
the  E’s,  we  can  add  it,  taking  bi  =  0. 
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PROOF.  Observe  that  (10)  is  equivalent  to  the  condition  that,  for  all  nonnegative 
reals  b\, . . . ,  bn- 1,  reals  bn,  and  all  «*,  it  is  not  the  case  that 

YJbj{Xj-x*)<bi,{Xi,-~x*.).  (11) 

!#»* 

Suppose,  by  way  of  contradiction,  that  there  exist  such  nonnegative  reals  6i, . . . ,  bn- 1 
and  real  bn.  Note  that,  without  loss  of  generality,  we  can  assume  that  i*  y^  n  and 
that  bi*  =  1.  For  if  bi*  y^  0,  then  we  can  divide  both  all  coefficients  on  both  sides 
by  bi*  to  get  an  equivalent  instance  of  (11)  where  bi*  =  1.  Moreover,  observe  that, 
since  7n_i  =  false  and  ijn  =  true ,  we  have  that  X„_i  =  0,  x^_1  =  0,  Xn  =  1,  and 
a;*  =  1.  Thus,  if  i*  =  n  or  if  bi *  =  0,  then  we  can  take  i*  =  n  —  1  and  bi *  =  1,  to 
get  an  equivalent  instance  of  (11).  Thus,  if  there  exist  bi, . . . ,  bn  and  i*  such  that 
(11)  holds,  then  we  can  assume  without  loss  of  generality  that  i*  y^  n  and  b t*  =  1. 

For  simplicity,  in  the  remainder  of  the  argument,  we  take  i*  =  1  (the  argument 
is  the  same  for  every  choice  of  i*  y^  n)  and  assume  that  b\  =  1.  Since  Xn  =  1  and 
a:*  =  1,  there  exist  nonnegative  b2, .... ,  b'n_1  and  e  >  0  such  that 

n—  1 

E  b'Mi  -  £j)  + <  Xy  -  *1- 

1=2 

Let  b'n  =  e  +  x\  —  b 'jx*j  (b'n  can  be  negative).  Note  that  J2j=2  ^'jxj  =  x\  +  e, 

since  x*  =  1.  Since  Xn  —  a:*  =  0,  it  follows  that 

n 

Y.b'jiXj-x^  +  eKX^xl. 

1=2 

Thus,  5Z"_26jXi  <  Xi.  By  definition  of  Bi,  there  exists  (b2, . . .  ,b^)  G  B\  such 
that  E=2  ^j-^l  <  -X'i  and  2  +  e.  In  other  words,  we 

can  assume  without  loss  of  generality  that  , . . . ,  b'rl  are  in  B\,  since  otherwise, 
we  can  always  replace  them  by  b2,  ■  ■  ■ ,  b*n.  By  the  above,  we  have  that  E(b'2X2  + 

. . .  +  b'nXn )  <  E(X i).  By  the  constraints  corresponding  to  /i  in  /,  we  can  therefore 
derive  b2E(X2)  +  ■  ■  ■  +  bln_1E(Xn-i)  +  bln  <  E(X i).  (The  constraints  corresponding 
to  /i  where  chosen  so  that  exactly  this  derivation  could  be  performed.)  However, 
replacing  b'n  by  e  +  x\  —  J2*j=2  ^jxj  anc^  replacing  E{Xf)  by  x*,  we  get  that  e  <  0, 
a  contradiction.  Thus,  there  cannot  exist  bi, ...  ,bn  of  the  above  form.  Hence,  P* 
is  coherent,  as  desired.  □ 

Continuing  with  the  proof  of  Theorem  5.2,  by  Lemma  A. 7  and  the  Natural 
Extension  Theorem,  there  exists  a  set  of  probability  measures  V  such  that  Efp 
is  defined  on  all  gambles,  and  E_v  agrees  with  P*  on  {Xi, . . . ,  Xn}.  It  is  routine  to 
check  that  (W,P,n)  |=  f,  and  hence  |=  /,  as  required. 

Theorem  5.3.  AXftei  is  a  sound  and  complete  axiomatization  of  CE  with  respect 
to  Mbel. 


PROOF.  Soundness  is  straightforward.  For  completeness,  we  proceed  as  in  The¬ 
orem  5.1.  Assume  without  loss  of  generality  that  /  is  a  conjunction  of  expectation 
inequalities  and  their  negations.  Using  axioms  E7,  E8,  and  E10  we  can  convert 
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/  into  the  equivalent  formula  fT 2  £  CE  (Lemma  A. 5)  where  e  is  applied  only  to 
propositional  formulas.  Every  propositional  formula  <p  in  fT2  is  provably  equivalent 
to  a  region  p,  for  some  1  <  i  <  22  .  Since  <p  =  pi  is  valid,  e(<p)  =  e(p,)  is  provable 
by  E5.  This  means  that  we  can  find  a  formula  f  provably  equivalent  to  fT2 ,  where 
e  is  applied  only  to  formulas  pi , . . . ,  p22 n  .  Let  f"  be  obtained  from  f  by  adding 
as  conjuncts  to  /'  all  the  instances  of  E9  involving  the  regions  pi, . . . ,  p22 jv  ,  as  well 
as  the  inequalities  e(p,)  >  0  for  all  1  <  *  <  22”,  e(pi)  >  1,  —  e(pi)  >  —1  and 
— e(p22jv)  >  0.  (Recall  that  by  assumption,  pi  is  true  and  p22 jv  is  false.)  It  is  not 
hard  to  see  that  these  formulas  are  provable,  hence  /"  is  provably  equivalent  to  /', 
and  hence  to  /. 

As  before,  the  negation  of  an  expectation  inequality  aie(7i)  +  •  •  •  +  ane(yn)  >  b 
can  be  written  — aie(7i)  —  •  •  •  —  ane( yn)  >  — b .  Thus,  without  loss  of  generality, 
we  can  assume  that  f"  is  the  conjunction  of  formulas  of  the  form  aie(pi)  +  •  •  •  + 
a22»e(p22jv)  >  b  and  — a'1e(pi)  —  •  •  •  —  a'22Ne(p22 n)  >  b'.  Let  /  be  the  system  of 
inequations  obtained  by  replacing  the  terms  e(pf)  by  the  variable  27,  for  1  <  i  < 
22  .  We  claim  that  f"  in  satisfiable  in  Aibel  iff  the  system  /  of  equations  has  a 
solution.  One  direction  is  straightforward.  Suppose  that  f"  is  satisfiable.  Thus, 
there  exists  a  belief  structure  (IT,  Bel,  7r)  such  that  (IT,  Bel,  7r)  |=  f".  Clearly,  taking 
Xi  =  EBei(^pift m)  =  Bel(pi)  gives  a  solution  to  /.  Conversely,  suppose  that  /  has  a 
solution,  say  x\, . . . ,  2Y2n  .  Let  pi,  ■  ■  ■  ,pn  be  the  primitive  propositions  appearing 
in  /  (and,  hence,  in  /").  Define  the  belief  structure  M  =  (IT,  Bel,  n)  as  follows: 

— IT  =  {<5i, . . . ,  <52™})  the  set  of  atoms  over  pi, . . .  ,pjv; 

— BeldA^ .,Sik})  =  x *,  where  i  is  the  unique  index  such  that  <5^  V  ...  V  Sik  is 

logically  equivalent  to  the  region  pp 
— n(Si)(p)  =  true  if  and  only  if  5i  =>  p  is  a  propositional  tautology. 

It  is  straightforward  to  show  that  Bel  defined  in  this  way  is  a  belief  function.  That 
Bel  satisfies  B1  and  B2  follows  from  the  fact  that  we  must  have  x\  =  0  and  x*2N  =  1. 
Similarly,  that  Bel  satisfies  B3  follows  from  the  observation  that  any  instance  of  B3 
corresponds  to  an  instance  of  E9  that  was  added  as  an  inequality  in  /,  and  thus 
is  satisfied  by  the  solution  x\, . . .  ,x^2N.  Finally,  that  M  ^  f"  holds  also  follows 

from  the  construction  of  /.  Thus,  f"  is  satisfiable.  This  completes  the  proof  of  the 
claim. 

Returning  to  the  proof  of  the  theorem,  we  want  to  show  that  if  /  is  consistent, 
then  /  is  satisfiable.  So  suppose  that  /  is  consistent  and,  by  way  of  contradicition, 
that  it  is  not  satisfiable.  Then  /"  is  not  satisfiable.  Thus,  by  the  claim,  the  system  of 
equations  /  has  no  solution.  Thus,  ->/"  is  an  instance  of  the  axiom  Ineq.  Since  /" 
is  provably  equivalent  to  /,  it  follows  that  ->/  is  provable,  so  that  /  is  inconsistent, 
a  contradiction.  □ 

Theorem  5.4.  AXposs  is  a  sound  and  complete  axiomatization  of  CE  with 
respect  to  Mposs . 

PROOF.  Soundness  is  straightforward.  For  completeness,  we  proceed  almost 
exactly  as  in  Theorem  5.3.  As  before,  we  can  reduce  to  showing  that  a  for¬ 
mula  /  consistent  with  AX.poss  that  is  a  conjunction  of  formulas  of  the  form 
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Oie(pi)  +  •  •  •  +  a2 2n  e{p22N )  >  b  and  —a^e^pi) - a'22N  e(p22jv)  >  b'  is  satisfiable. 

We  add  as  conjuncts  to  this  formula  all  the  expectation  inequalities  corresponding 
to  Ell  involving  the  regions  pi,.  ■■ ,  p2  2jv,  as  well  as  the  inequalities  e{pi)  >  0  for 
all  1  <  i  <  22”,  e(pi)  >  1,  —  e(pi)  >  —1  and  —e(p22 «)  >  0.  Again,  let  /  be 
the  system  of  inequations  formed  by  replacing  e{p/j  by  Xi.  Arguments  similar  in 
spirit  to  those  of  Theorem  5.3  can  be  used  to  show  that  /  has  a  solution  iff  there 
is  a  structure  in  A4poss  satisfying  /;  we  leave  details  to  the  reader.  The  proof  is 
completed  using  Ineq,  just  as  the  earlier  completeness  proofs.  □ 

A. 4  Proofs  for  Section  6 

As  in  FHM  and  HP,  the  small  model  theorems  we  prove  rely  on  the  following  lemma, 
which  can  be  derived  from  Cramer’s  rule  [Shores  1999]  and  simple  estimates  on  the 
size  of  the  determinant  (see  also  Chvatal  [1983]  for  a  simpler  variant): 

Lemma  A. 8.  If  a  system  of  r  linear  equalities  and/or  inequalities  with  integer 
coefficients,  each  of  length  at  most  l,  has  a  nonnegative  solution,  then  it  has  a 
nonnegative  solution  with  at  most  r  positive  entries,  where  the  size  of  each  element 
of  the  solution  is  0{rl  +  r  log(r)). 

Before  getting  to  the  small  model  theorems,  we  first  establish  a  finite  model 
theorem,  that  is,  we  show  that,  for  all  the  representations  of  uncertainty  we  consider 
in  this  paper,  if  a  formula  in  CE  is  satisfiable,  it  is  in  fact  satisfiable  in  a  structure 
with  finitely  many  states.  This  is  a  consequence  of  the  completeness  proofs  in 
Section  5. 

Lemma  A. 9.  Suppose  f  G  CE  is  satisfied  in  some  structure  in  Jvlprob  (resp., 
Mlp ,  Mbel,  Mposs).  Then  f  is  satisfied  in  a  structure  in  Mprob  (resp.,  Mlp , 
Mbel ,  Mposs)  with  finitely  many  states. 

PROOF.  In  each  of  the  proofs  of  Theorems  5. 1-5.4,  we  show  that  a  formula 
is  satisfiable  iff  a  certain  system  of  inequations  has  a  solution.  The  system  of 
inequations  involves  only  finitely  many  variables.  Our  argument  showing  that  if 
the  system  of  inequations  is  satisfiable,  then  there  is  a  structure  where  the  formula 
is  satisfied  actually  shows  that  the  satisfying  structure  has  only  finitely  many  states, 
with  no  more  than  one  state  per  variable  in  the  system.  □ 

Note  for  future  reference  that  the  satisfying  structures  in  JVlproh  and  Mlp  con¬ 
structed  in  the  proofs  of  Theorems  5.1  and  5.2  are  such  that  all  subsets  are  mea¬ 
surable. 

Theorem  6.1.  Suppose  that  f  G  CE  is  satisfied  in  some  structure  in  Xilp .  Then 
f  is  satisfied  in  a  structure  (W,V,tt)  such  that  \W\  <  |/|2,  \P\  <  \f\,  p(w)  is 
a  rational  number  such  that  ||/i(tu)||  is  0(|/|2||/||  +  | / 1 2  log ( | / 1 ) )  for  every  world 
w  €  W  and  p  G  V,  and  7r(w)(p)  =  false  for  every  world  w  G  W  and  every  primitive 
proposition  p  not  appearing  in  f. 

PROOF.  The  first  step  in  the  proof  involves  showing  that  if  V  is  a  set  of  proba¬ 
bility  measures  defined  on  a  finite  space  W  (assuming  all  subsets  are  measurable), 
and  if  X\ , . . . ,  Xn  are  gambles  over  W,  then  we  can  assume  without  loss  of  gen¬ 
erality  that  for  each  gamble  Xt,  there  is  a  probability  measure  px,  G  V  such 
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that  Elix\Xi )  =  Ev(Xi)  (rather  than  Ev(Xf)  just  being  the  inf  of  E^Xf)  for 
/i£?).  A  similar  result  is  proved  in  HP  for  upper  probabilities.  More  specifically, 
in  HP,  it  is  shown  that,  given  V,  there  exists  a  set  V'  D  V  such  that,  for  each 
S  C  W,  Ep(Xs)  =  Ev,(Xs)  and,  moreover,  there  exists  some  /is  £  V  such 
that  /ig (5)  =  Ev(Xs).  The  next  result  can  be  viewed  as  a  generalization  of  this 
result  to  arbitrary  gambles.  It  is  proved  using  essentially  the  same  technique  as  the 
corresponding  result  in  HP. 

Lemma  A.  10.  Let  V  be  a  set  of  probability  measures  defined  on  a  finite  set  W 
of  worlds,  and  let  Xi, . . . ,  Xn  be  gambles  over  W.  Then  there  exists  a  set  V'  of 
probability  measures  such  that,  for  each  gamble  Xi,  (a)  E-p(Xi)  =  Ep,(Xi),  and 
(b)  there  is  a  probability  measure  px,  €  V  such  that  EIXX  (Xi)  =  E_v(Xi). 

PROOF.  To  show  that  V'  exists,  it  clearly  suffices  to  show  that,  for  each  gamble 
X  £  {X\, . . .  ,Xn},  there  is  a  probability  measure  px  such  that  E/lx(Y)  >  EV,(Y) 
for  all  Y  £  {Xi, . . . , Xn}  and  Ellx (X)  =  EV(X). 

Given  a  gamble  X  £  {X\, . . .  ,Xn},  if  there  exists  p  £  V  such  that  E^(X)  = 
EV(X),  then  we  are  done.  If  not,  there  must  be  a  sequence  pi,  p2,  ■ . .  of  measures 
in  V  such  that  lim^oo  Eltn  (X)  =  EV(X).  Suppose  that  W  =  {w\, . . . ,  wn}.  By 
the  Bolzano- Weierstrass  theorem  [Rudin  1976]  (which  says  that  every  sequence  of 
real  numbers  has  a  convergent  subsequence),  the  sequence  pi(wi),  P2(w i),  ps(wi), 

. . .  has  a  convergent  subsequence.  Suppose,  inductively,  that  we  have  found  a 
subsequence  pjp,  Pjt 2,  •  •  •  of  pi,  P2,  ■  ■  ■  such  that  Pjp(w),  pjt2(w),  pj$(w), . . .  con¬ 
verges  for  w  €  {uq, . . . ,  Wj}.  By  applying  the  Bolzano- Weierstrass  Theorem  again, 
there  is  a  subsequence  pj+ip,  pj+2,1,  ■  ■  ■  of  Pj,i,  Pj,2,  ■  •  ■  such  that  pj+\p(wj+ 1), 
Pj+2,i(wj+i),  . . .  converges.  It  follows  that  Pj+p\(w),  Pj+2,w),  ■  ■  ■  converges  for  all 
w  £  {uq, . . . ,  By  induction,  we  can  find  a  subsequence  pn,i,  pn,2,  •  •  •  of  the 

original  sequence  such  that  pnp(w),  pnp(w), . . .  converges  for  all  w  £  W.  Suppose 
that  pn,i(wi) ,  pn,2(wi) , . . .  converges  to  pi.  It  is  easy  to  see  that  p\  +  ■  ■  ■  +  pn  =  1, 
since  pn,j(wi)  =  1  for  all  j.  Let  px  be  the  probability  measure  such  that 
p(wi)  =  pi .  Since  pnj  — >  px,  it  must  be  the  case  that  Eflx(X)  =  EV(X). 
Moreover,  since  pnj  £  V  for  all  j,  it  must  be  the  case  that  E)ln.  (Y)  >  EV(Y) 
for  all  j.  Thus,  Eflx(Y)  >  EV(Y),  as  desired. 

Now  let  V  =  V  U  {p-x, ,  •  •  • ,  Pxn}-  L”  clearly  has  the  desired  properties.  □ 

Continuing  with  the  proof  of  Theorem  6.1,  suppose  that  /  is  satisfiable  in  A4lp. 
By  Lemma  A. 9,  /  is  satisfied  in  a  lower  probability  structure  with  a  finite  set  W 
of  worlds.  Thus,  by  Lemma  A. 10,  /  is  satisfied  in  a  structure  M  =  (W,V,  n)  such 
that,  for  all  X  £  {Xi, . . .  ,Xn},  there  exists  px  G  V  such  that  Ellx  (X)  =  EV(X). 

The  rest  of  the  proof  also  continues  in  much  the  same  spirit  as  the  proof  of  the 
analogous  result  in  HP.  A  straightforward  induction  on  structures  shows  that  we 
can  find  a  formula  equivalent  to  /  in  disjunctive  normal  form,  where  each  disjunct 
has  length  at  most  |/|.  (The  inductive  hypothesis  states  that  we  can  find  both  a 
DNF  formula  equivalent  to  /  where  each  disjunct  has  length  at  most  |/|,  and  a 
CNF  formula  equivalent  to  /  where  each  conjunct  has  length  at  most  |/|.)  Since  a 
formula  in  DNF  is  satisfiable  iff  one  of  its  disjuncts  is,  we  can  thus  assume  without 
loss  of  generality  that  /  is  a  conjunction  of  inequality  formulas  and  negations  of 
inequality  formulas.  Let  pi,  ■  ■  ■  ,pn  be  the  primitive  formulas  appearing  in  /.  Let 
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Si, . . . ,  52n  be  the  atoms  over  pi, . .  ■  ,pn-  As  in  the  proof  of  completeness,  we  derive 
a  system  of  equalities  and  inequalities  from  /,  but  it  is  a  slightly  more  complicated 
system  than  that  used  in  the  completeness  proof.  Recall  that  each  propositional 
formula  over  pi , . . . ,  pjv  is  a  disjunction  of  atoms.  Let  71 , . . . ,  7*,  be  the  propositional 
gambles  that  appear  in  g.  Notice  that  k  <  \f\  (since  there  are  some  symbols  in  /, 
such  as  the  coefficients,  that  are  not  in  the  propositional  formulas).  The  system 
of  equations  and  inequalities  we  construct  involve  variables  xtj,  where  i  =  1, . . . ,  k 
and  j  =  1,...,2n.  Intuitively,  Xij  represents  where  gli  £  V  is  such 

that  Thus,  the  system  includes  k  <  \  f\  equations  of 

the  form 

Xu  +  •  •  •  +  Xi2N  =  1, 

for  i  =  1  ,...,k.  Suppose  that  7 j  is  equivalent  to  buS  1  +  •••  +  6,; 2n52n.  Then 

hiXn-\ - \-bi2NXi2N  represents  E^,  Since  E^,  <  £>({|7i|}M) 

for  all  /i  £  V,  the  system  includes  k2  —  k  inequalities  of  the  form 

bi\Xn  +  •  •  •  +  bi2NXi2N  <  buXi'i  +  •  •  •  +  bi2N x^2n  , 

for  each  pair  i,  il  such  that  i  7^  i' .  For  each  conjunct  in  g  of  the  form  die(7i)  +  •  •  •  + 
a«e(7fc)  >  b ,  there  is  a  corresponding  inequality  where,  roughly  speaking,  we  replace 

e(7 i)  by  ({|7i[ }m)-12  Since  H7*] }M  corresponds  to  baXa  H - bi2NXi2N ,  the 

appropriate  inequality  is 

k 

'y  )  diibiiXn  +  •  •  •  +  bi2N Xi2n)  >  b. 

i= 1 

Negations  of  such  formulas  correspond  to  a  negated  inequality  formula;  as  before, 
this  is  equivalent  to  a  formula  of  the  form 

k 

ai(bilXil  +  •  •  •  +  bi2NXi2N )  >  — b . 

i=l 

Notice  that  there  are  at  most  |/|  inequalities  corresponding  to  the  conjuncts  of  /. 
Thus,  altogether,  there  are  at  most  k(k  —  1)  +  2|/|  <  |/|2  equations  and  inequalities 
in  the  system  (since  k  <  |/|).  We  know  that  the  system  has  a  nonnegative  solution 
(taking  Xj  to  be  £t7i ([^]m))-  It  follows  from  Lemma  A. 8  that  the  system  has  a 
solution  x*  =  {x\x, . . . ,  x*12N, . . . ,  x*kl, . . . ,  x*k2N )  with  t  <  |/|2  entries  positive,  and 
with  each  entry  of  size  0(|/|2||/||  +  |/|2  log(|/|)). 

We  use  this  solution  to  construct  a  small  structure  satisfying  the  formula  /.  Let 
I  =  {i  :  x*j  is  positive,  for  some  j};  suppose  that  /  =  {*i, . . . ,  it>}  for  some  t!  <  t. 
Let  M  =  ( W ,  V,  7 r),  where  W  has  t '  worlds,  say  Si, . . . ,  st>.  Let  n(sh)  be  the  truth 
assignment  corresponding  to  the  formula  5ih,  that  is,  n(sh)(p)  =  true  if  and  only 
if  Sih  =>  p  is  a  propositional  tautology  (and  where  ir(sh)(p)  =  false  if  p  does  not 
appear  in  /).  Define  V  =  {p,j  :  1  <  i  <  k },  where  Hj(sh)  =  x*hy  It  is  clear 
from  the  construction  that  M  |=  /.  Since  \P\  =  k  <  |/|,  \W\  =  t'  <  t  <  |/|2  and 


12  For  simplicity  here,  we  are  implicitly  assuming  that  each  of  the  formulas  7;  appears  in  each 
conjunct  of  /.  This  is  without  loss  of  generality,  since  if  7^  does  not  appear,  we  can  put  it  in, 
taking  ai  =  0. 
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lij(sh)  =  x*hj,  where,  by  construction,  the  size  of  x*hj  is  0(|/|2||/||  +  |/|2  log(|/|)), 
the  theorem  follows. 

Theorem  6.2.  Suppose  that  f  £  CE  is  satisfied  in  some  structure  in  A4bel 
(resp.,  AipossJ.  Then  f  is  satisfied  in  a  structure  (W,u,  ir)  such  that  \  W\  <  \f\2,  v 
is  a  belief  function  (resp.,  possibility  measure)  whose  corresponding  mass  function 
is  positive  on  at  most  \  f\  subsets  ofW  and  the  mass  of  each  of  these  \  f\  is  a  rational 
number  of  size  0(\f\  ||/||  +  |/|log(|/|)),  and  n(w)(p)  =  false  for  every  world  w  £  W 
and  every  primitive  proposition  p  not  appearing  in  f. 

PROOF.  First,  consider  expectation  for  belief  functions.  The  proof  is  similar  in 
spirit  to  the  proof  of  the  small  model  theorem  for  reasoning  about  belief  functions 
given  in  FHM.  In  FHM,  the  complexity  result  used  the  representation  of  belief 
functions  in  terms  of  mass  functions.  We  do  that  here  too;  to  do  so,  it  is  helpful  to 
have  an  alternate  characterization  of  expectation  for  belief  that  uses  mass  functions. 

Given  a  belief  function  Bel  over  a  finite  set  W  of  worlds,  let  m  be  the  correspond¬ 
ing  mass  function.  For  a  given  gamble  X,  let  i>u  =  rnin^gf/  X(w). 

Lemma  A. 11.  EBei(X)  =  J2ucw  ni(U)vu. 

PROOF.  Suppose  that  Bel  is  a  belief  function  on  W  with  corresponding  mass 
function  ?n,  and  X  is  a  gamble  on  a  finite  set  W  =  {u'i , . . . ,  wn},  where  the  elements 
of  W  are  ordered  so  that  i  <  j  implies  X(wi)  <  X(wj).  For  each  U  C  W,  let 
iu  =  min{i  :  Wi  £  U} ;  note  that  vjj  =  X(wiv). 

—Bel  (^0  =  m(U)VU- 

UCW 

We  want  to  show  that  i?Bel(X)  =  EBe\(X). 

Recall  from  Section  2.3  that  EBe l  =  ElvUkI  ,  where  Peel  is  the  set  {) a  :  fx(U)  > 
Bel (U)  for  all  U  C  W}.  As  a  first  step,  let  po  be  a  probability  measure  on  W  such 
that  po(X  =  x)  =  m(U).  (Note  that  po  is  a  probability  measure,  since 

5Z  hox  =  x=  H  =  H  rn([/)  =  1> 

x6V(X)  x£V(X)  {U:vu=x}  U<ZW 

since  mis  a  mass  function.)  Clearly 
EIM)(X)=  J2  x^o(X 

x£V(X) 

=  ^  m(U)vu 

UCW 

Moreover,  for  all  U  C  W,  since  po(U)  =  J2^v.w.  eUyna(V),  and  wiv  £  U  for 
all  V  C  U,  it  follows  that  po(U)  >  J2{yWi  el j}m(V)  =  Bel(/7).  It  follows  that 
Po  €  PBei-  Thus, 

EBel(X)  =  E„0(X)  >  inf  E^X)  =  EVbJX )  =  EBel(X). 

To  show  that  EVb^(X)  >  EBel(X),  let  x\  <  ■  ■  ■  <  Xk  be  the  values  of  X  in 
increasing  order,  and  let  Uj  =  U^=1(X  =  Xj)  =  {w  £  W  ■.  X(w)  <  xjj.  We 
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claim  that  po (Uj)  =  Plaus(C/,),  j  =  1 ,k.  This  is  almost  immediate  from  the 
definition,  since 

MUj)  =  E  m(U)  =  ^  m{U)  =  Plaus  (£/,). 

{U:vu<Xj}  {U:Ur\U^0} 

It  follows  that  if  p  G  'pBeb  then  Po(Uj)  >  p(Uj),  for  j  =  1 ,k  (since  p(Uj)  < 
Plaus(I7,)).  For  convenience,  define  Uq  =  0.  Then  we  get  that 

E^X)  -  E^X)  =  =  *i)  -  M*  -  *i)) 

=  Ei= 1  Xi((n(Ui)  -  n(Ui- 1))  -  (/Zo(^i)  -  Mo(^i-i))) 

=  xk{p{Uk)  -  /z0 (/7fc))  +  Xlti1  (**+1  -  Xi)(tM){Ui)  -  n(Ui)) 

>  0. 

The  last  inequality  follows  from  the  fact  that  p{Uk)  =  po{Uk)  =  /zo(W)  =  1, 
*»+i  >  xu  and  Ho(Ui)  >  /z(C/i)  for  i  =  1, . . . ,  k  -  1.  Thus,  EIXo(X)  =  EVbb1(X).  It 
follows  that  EBel(X)  =  EVbb1(X).  □ 

Continuing  with  the  proof  of  Theorem  6.2,  suppose  that  /  G  CE  is  satisfiable 
in  structure  M.  As  in  the  proof  of  Theorem  6.1,  we  can  assume  without  loss  of 
generality  that  f  is  a  conjunction  of  expectation  formulas  and  their  negations.  Let 
Si,...,  S2n  be  the  atoms  over  p±, . . .  ,Pn-  Let  pi, . . . ,  po2"  be  all  the  inequivalent 
propositional  formulas  over  p\, . . .  ,Pn- 

As  in  the  proof  of  completeness,  we  derive  a  system  of  equalities  and  inequalities 
from  /.  First,  note  that  every  propositional  formula  appearing  in  the  gambles  of  / 
is  provably  equivalent  to  some  region  pi.  Therefore,  we  can  replace  every  gamble 
in  /  by  an  equivalent  gamble  where  the  propositional  formulas  are  the  regions 
pi,...,  p2?n  .  Let  /'  be  resulting  formula.  Clearly,  M  ^  /'.  Construct  the  following 
system  of  linear  inequalities  over  the  variables  xi,...  ,x22n  ,  where,  intuitively,  the 
variable  Xi  stands  for  the  mass  corresponding  to  the  set  pi.  For  every  gamble  7 
that  appears  in  f  every  pi,  we  can  compute  values  u7i;  =  mint(,g[pijM ({|7|}m(w)). 

22N 

For  every  gamble  7,  replace  every  term  e(7)  in  /'  by  Ez=i  xiV1:i-  Consider  the 
system  f  of  at  most  |/|  inequalities  (over  unknowns  xi,. . .  ,x22n)  resulting  from 
this  process,  after  putting  together  like  terms,  along  with  the  inequalities  Xi  +  •  •  •  + 
x22n  >  1  and  —xi  —  ■  ■  ■  —  x22n  >  —1. 

We  now  show  that  any  nonnegative  solution  x\ , . . . ,  of  f  can  be  used  to 
construct  a  belief  function  Bel*  such  that  (W,  Bel*,7r)  \=  /'.  (Note  that  we  keep 
the  same  worlds  and  interpretation  as  in  M.)  Let  x^,. . .  ,x*2jv  be  a  nonnegative 

solution  of  /.  Define  the  mass  function  m*{\pi\M)  =  x *,  and  define  m*(U )  =  0 
for  all  U  C  W  such  that  U  is  not  of  the  form  [p]M  for  some  region  p.  Because 
x\  +  ...  +  x*2N  =  1  (by  choice  of  /'),  m*  is  indeed  a  mass  function.  Let  Bel* 
be  the  belief  function  corresponding  to  ?n*,  and  let  M*  =  (IT, Bel*,7r).  Since  the 
interpretation  of  propositional  formulas  and  gambles  depends  only  on  the  set  of 
worlds  and  the  interpretation  n,  for  all  propositional  formulas  pi,  we  have  [/0;]m  = 
I/7:]m*,  and  for  all  gambles  7  appearing  in  f,  we  have  {|7[}m  =  UtIIm*-  We  now 
show  that  M*  |=  /'.  Let  aie(7i)  +  . . .  +  ake{^k)  >6  be  a  conjunct  in  /'.  (A  similar 
argument  works  for  the  negation  of  expectation  inequalities.)  We  know  from  the 


Journal  of  the  ACM,  Vol.  V,  No.  N,  May  2007. 


40 


J.  Y.  Halpern  and  R.  Pucella 


construction  of  /'  and  the  fact  that  x\ , . . . ,  x*2N  is  a  solution  of  /'  that 

0N  0N 

22  22 

ai  +  . . .  +  ak  >  b. 

i= 1  i=  1 

By  definition,  this  is  just 


°i  m*dPii  m)  min  (UtiB-mM) 
— ,  welPijM 

i=i 


aky2m*(lpi]  m)  min  (Hya-Ha/M)  >  b. 

Since  every  subset  of  W  is  of  the  form  [pj]M  for  some  i,  we  have 

cli  Y]  m*(U)  min({|7i|}M(w))  +  . . .  +  ak  Y]  m* (U)  min(^k§M(w))  >  b. 

2 — '  W(zlTJ  2 — '  inC-TT 


ucw 


ucw 


w£U 


But  by  Lemma  A. 11,  this  is  just  cq  EBei*  ({|yi|}m)  +  •■•  +  akEBei*  >  b, 

which  is  equivalent  to  ai£,Bei*({|7i|}M*)  +  ...  +  akEBe\*  ({|7fc|}M*)  >  b,  and  thus 
M*  \=  aie(7i)  +  . . .  +  ake{ 7*,)  >  b.  It  follows  that  M*  \=  f. 

Because  f  is  satisfiable  in  M,  there  is  in  fact  a  nonnegative  solution  to  the 
system  f,  where  27  =  m({pi}M)  and  m  is  the  mass  function  corresponding  to 
the  belief  function  in  M.  By  Lemma  A. 8,  there  is  a  small  nonnegative  solution 
x\, . . .  ,x*22n  ,  that  is,  one  with  at  most  |/|  positive  entries  and  each  entry  of  size 
0((|/|)||/||  +  (|/|)log(|/D).  By  the  argument  above,  x*, . . .  ,x*2„  can  be  used  to 
construct  a  model  M*  =  (W,  Bel*,7r)  such  that  M*  \=  f.  We  are  not  quite  done 
yet;  while  we  have  a  small  mass  function,  we  still  have  potentially  too  many  worlds. 
We  now  show  how  to  cut  down  the  number  of  worlds  in  the  model  to  get  a  small 
enough  structure  M' . 

Let  {*i, . . .  ,i\f\}  =  {i  '■  ui*([[/3.;]m*)  >  0}.  Let  7i,...,7fc  be  the  gambles  in 
/'.  For  i  G  {1, . . . ,  k}  and  j  €  {1, . . . ,  |/|},  there  is  some  Wij  €  [/yJm*  such  that 
=  min^gjp.^  ({|74m(w));  that  is,  witj  is  a  world  where  H7 i\M  attains 
its  minimum  value.  Define  M'  =  (W' ,  Bel7,  7 r')  as  follows.  Let  the  set  of  states  W'  be 
{wi:j  :  i  €  {1, . . . ,  k},j  €  {1, . . . ,  |/|}}.  Let  Bel'  be  the  belief  function  whose  corre¬ 
sponding  mass  function  ml  is  defined  by  setting  m!  ( {u>i  j , . . . ,  wk  j  } )  =  m*  ( \pi  ■  ]  m  * ) 
for  j  =  1, . . . ,  I/I,  and  m'{U)  =  0  if  U  is  not  [p»Jm*  for  some  j  €  {1, . . . ,  |/|}. 
The  interpretation  7r'  is  simply  the  restriction  of  7r  to  W\  with  ir(w)(p)  =  false  for 
primitive  propositions  p  not  appearing  in  /.  This  model  satisfies  the  size  conditions 
of  the  theorem. 

We  now  check  that  /'  (and  hence  /)  is  satisfiable  in  M' .  It  is  clearly  sufficient  to 
show  that  for  every  gamble  7 j  in  /',  we  have  ^Bei*  (IKIIm*)  =  £Bei'({|7i|}M')-  To 
do  this,  we  show  that 


=  min  (-Mm'CuVj)).  (12) 

l<r<fc 

By  choice  of  witj,  H7 '4m*  (mj)  =  min,„e[p  ]M„  ({|7i|}M*  (w))-  Since  {wi  ,j,  •  •  • ,  wkp} 
is  a  subset  of  [/tJm*,  it  follows  that  =  mini<r<fe({|7j|}M*(uVj)). 
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Next  note  that  for  all  w  G  {uqj,  •  •  •  we  have  that  {]7i[}M*(w)  = 

For  if  7 i  =  ci ph  +  . . .  +  cipjn  then  Mm*  =  Ci^[Pji]m,  +  •  •  •  +  ciXlPj jM„  and 
|7*[ }m'  =  cix\Pjl\M,  +  ■  •  •  +  CiXlp.jM,.  Since  tt'  is  the  restriction  of  tt*  to  W’, 
it  follows  that  [PjJm*  =  Ip j  J  M'  H  W' .  Since  {wij, . . . ,  Wk,j}  Q  W' ,  it  follows 
that  Xlpj  ]m,(w)  =  X1pji1m,(w)  for  all  w  G  {whj, . . .  ,wkj}.  Thus,  Mm*M  = 
for  all  w  G  {wij, . . .  ,Wk,j}-  We  can  now  show  that  -EBei*({|7i|}AA*)  = 

-EWUNIm'): 

-EBel*({|7iG'Af*) 

2N 

=  ELl  TO*([P*lM*)minr«e[p,]M*(-874Af*M) 

=  E|=1  minwe[p.jM,  (Mm*  M)  (since  m*(U)  =  0  if  U  ±  \pi] ]M*) 

=  Ei=i  m* (lPij\M-)hihi‘ (wi,j)  (by  choice  of  witj) 

=  El=i  . .  .,wfcj}){|7i|}M*(wi,j) 

=  Ej=im,({wi7>--->u;fej})mini<r<fc({|7i|}M'(tcrj))  (by  (12)) 

=  Etrcw'  m'(U)  mintu  G  (adding  sets  for  which  m'(U)  =  0) 

=  £Bel'({]7i[}M')- 


From  this  result,  it  is  easy  to  see  that  M'  ^  f,  and  hence  M’  \=  f.  This  establishes 
the  small-model  result  for  CE  interpreted  over  belief  functions. 

Essentially  the  same  argument  works  in  the  case  of  possibility  measures.  Recall 
that  a  possibility  measure  Poss  is  just  a  plausibility  function,  whose  corresponding 
mass  function  m  is  consonant ;  that  is,  for  all  sets  U,  V  such  that  m(U)  >  0  and 
m(V)  >  0,  we  have  either  U  C  V  or  V  C  U  [Dubois  and  Prade  1982].  In  other 
words,  the  sets  of  positive  mass  U\, . . .  ,Uk  can  be  ordered  such  that  Ui  C  ...  C 
Uk-  We  then  proceed  much  as  for  belief  functions.  We  construct  a  system  of 
inequalities  over  the  variables  X\, . . .  ,27,  where,  Using  Lemma  A. 8  again,  because 
/'  is  satisfiable  in  M,  there  is  a  small  nonnegative  solution  with  at 

most  I/I  positive  entries,  each  of  small  size.  We  can  then  use  this  solution  to  build 
a  structure  satisfying  /  where  the  mass  function  is  consonant  and  positive  on  at 
most  | /|  sets.  This  follows  directly  from  the  fact  that  the  only  sets  of  positive 
mass  will  be  among  Ui, . . . ,  Uk,  which  are  already  such  that  U\  C  ...  C  Uk-)  The 
remainder  of  the  proof  goes  through  as  in  the  belief  function  case. 

Theorem  6.3.  The  problem  of  deciding  whether  a  formida  in  CE  is  satisfiable 
in  Mprob  (resp.,  Mlp ,  Mbel,  Mposs)  is  NP-complete. 

PROOF.  The  result  for  J\Aprob  is  immediate  from  the  proof  that  the  satisfiability 
problem  for  Cfu  (the  restriction  of  C®u  to  rational  coefficents)  is  NP-complete, 
together  with  the  argument  in  Theorem  4.1  showing  that  every  formula  in  CE  is 
equivalent  to  a  formula  in  CfU  of  the  same  length  (where  the  formula  is  essentially 
given  by  the  translation  of  Lemma  A. 4). 

Consider  Xilp .  The  lower  bound  follows  from  the  fact  that  we  can  reduce 
propositional  satisfiability  to  the  decision  problem  for  CE\  hence  the  problem  is 
NP-hard  (by  replacing  each  proposition  p  by  the  formula  e{p)  =  1).  The  upper 
bound  follows  from  Theorem  6.1.  Given  a  formula  /,  first  guess  a  small  model 
M  =  (W,V,n),  of  the  form  guaranteed  to  exist  by  Theorem  6.1.  (The  fact  that 
ir(w)(p)  =  false  for  every  world  w  G  W  and  every  primitive  proposition  p  not 
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appearing  in  /  means  that  we  must  describe  7 r  only  for  propositions  that  appear  in 
/.)  We  can  verify  that  M  \=  f  inductively.  For  inequality  formulas,  let  e(y)  be  an 
arbitrary  expectation  term  in  the  formula,  with  7  of  the  form  b\p\  +  •  •  •  +  bnpn. 
For  each  p  in  7,  we  compute  \p\m  by  checking  the  truth  assignment  of  each  world 
in  W  and  seeing  whether  this  truth  assignment  makes  ip  true.  We  then  replace 
each  occurrence  of  e(y)  by  min/ie-P{^"=1  hh(w)}  and  verify  that  the 

resulting  inequality  holds.  It  is  easy  to  see  that  this  verification  can  be  done  in 
time  polynomial  in  |/|  and  ||/||.  Therefore,  the  decision  problem  is  in  NP,  and 
hence  is  NP-complete. 

Finally,  consider  A4bel  and  Aiposs.  As  earlier,  the  lower  bound  follows  from  the 
fact  that  we  can  reduce  propositional  satisfiability  to  the  decision  problem  for  CE\ 
hence,  the  problem  is  NP-harcl.  Again,  the  upper  bound  follows  from  Theorem  6.2. 
Given  a  formula  /,  guess  a  small  model  M  =  (W,  v ,  7r)  of  the  form  guaranteed 
to  exist  by  Theorem  6.2,  along  with  sets  Ui, ...  ,US  (s  <  |/|)  such  that  the  mass 
function  corresponding  to  the  belief  function  (respectively,  possibility  measure)  v 
is  positive  only  on  U±, ...  ,US.  We  then  verify  that  /  is  indeed  true  at  some  (and 
hence  all)  states  in  the  model,  just  as  in  the  case  of  Mlp .  □ 

A. 5  Proofs  for  Section  7 

The  following  lemmas  are  useful  in  the  proof  of  Theorem  7.1. 

Lemma  A.  12.  The  formula  p  >  0  is  provable  in  AX9. 

PROOF.  Here  is  a  sketch  of  the  derivation: 

(1)  true  =  1  (G3) 

(2)  p  V  -up  =  true  (G4) 

(3)  p  V  —<p  =  p  +  —ip  (Gl) 

(4)  p  +  -<p  =  1  (1,  2,  3,  IneqF,  Taut,  MP) 

(5)  p  +  <p  >  0  (4,  IneqF) 

(6)  p  >  0  (5,  G2). 

□ 

Lemma  A.  13.  The  formula  (ap  +  b^p  >  0)  =>  {p  =  0)  is  provable  in  AX9,  for 
a  <  0. 

PROOF.  Here  is  a  sketch  of  the  derivation: 

(1)  ap  +  b^p  >0=>ap>0  (G2,Taut,MP) 

(2)  ap  >  0  p  <  0  (IneqF,  since  a  <  0) 

(3)  p  >  0  (Lemma  A.  12) 

(4)  ap  +  b~^p  >  6  =>  p  =  0  (1,  2,  3,  Taut,  MP,  definition  of  =). 

□ 


Theorem  7.1.  AX9  is  a  sound  and  complete  axiomatization  of  C9  with  respect 
to  M9 . 
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PROOF.  Soundness  is  straightforward.  For  completeness,  we  show  that  an  un- 
satisfiable  formula  /  is  inconsistent.  We  first  reduce  /  to  a  canonical  form.  Let 
ji  V  ...  V  jr  be  a  disjunctive  normal  form  expression  for  /  (where  each  g j  is 
a  conjunction  of  gamble  inequalities  and  their  negations).  Using  propositional 
reasoning  (axioms  Taut  and  MP),  we  can  show  that  /  is  provably  equivalent  to 
this  disjunction.  Since  /  is  unsatisfiable,  each  g^  must  also  be  unsatisfiable.  Thus, 
it  is  sufficient  to  show  that  any  unsatisfiable  conjunction  of  gamble  inequalities  and 
their  negations  is  inconsistent. 

Let  /  be  such  an  unsatisfiable  conjunction  of  gamble  inequalities  and  their 
negations.  Let  pi,...,pn  be  the  primitive  propositions  appearing  in  /,  and  let 
<5i , . . . ,  <52«  be  a  canonical  listing  of  the  atoms  over  p\, . . .  ,px.  We  first  show 
that  any  gamble  inequality  7  >  c  is  provably  equivalent  to  a  gamble  inequality 
a-[ +  •  •  •  +  a2N<j2iv  >  0.  Consider  a  term  cup  appearing  in  7  >  c.  Since  p  is 
equivalent  to  a  disjunction  6^  V ...  V  5ik ,  we  have  that  p  =  8^  V . . .  V  5ik ,  and  hence 
cup  =  a((5q  V  ...  V  Sih),  is  provable  by  G4  and  IneqF.  By  repeated  applications  of 
Gl,  we  have  that  a(Sj1  V  . . .  V  6ik)  =  aS q  +  •  •  •  +  aSik  is  provable.  (Note  that  if  <p 
and  tp'  are  mutually  exclusive,  then  p  V  p'  is  equivalent  to  p  A  p  V  p'  A  —up,  so  by 
Gl,  p  V  p'  =  >p  +  p' .)  By  IneqF,  ap  =  aSit  +  •  •  •  +  aSik  is  provable  too.  Using 
IneqF  again,  it  follows  that  ap  =  aqdi  +  •  •  •  +  o2jv52n  is  provable,  where  a,  =  a 
if  i  £  {*i, . . . ,  ik}i  and  a*  =  0  otherwise.  Doing  this  to  every  term  in  7  shows  that 
here  exist  b±, ... ,  62™  such  that  7  =  £»i<5i  +  •  •  •  +  62jv(52jv  is  provable.  Hence,  using 
IneqF,  so  is  a-\  8-\  +  •  •  •  +  a2jv(52N  >  c.  By  G3,  true  =  1  is  provable,  hence  so  is 
c  true  =  c.  It  then  easily  follows  using  IneqF  that  c5 1  +  •  •  •  +  o52«  =  c  is  provable. 
Thus,  7  >  c  is  provably  equivalent  to  (ai  —  c)<5i  +  •  •  •  +  (a2w  —  c)S2n  >  0,  as  required. 

It  immediately  follows  that  /  is  provably  equivalent  to  a  formula  f  that  is  a 
conjunction  of  gamble  inequalities  of  the  form  ai<Ii  +  •  •  •  +  q2n82n  >  0  and  their 
negations.  Say  that  f  consists  of  r  gamble  inequalities  and  s  negations  of  gamble 
inequalities.  Consider  two  arrays  of  coefficients  of  f”:  P  =  (aij),  where  is 
the  coefficient  of  Sj  in  aip8\  +  •  •  •  +  ai  2iv52N  >  0  (1  <  *  <  r),  and  N  =  (hj), 
where  bij  is  the  coefficient  of  Sj  in  ~<(bipSi  +  •  •  •  +  2jv52w  >0)  (1  <  i  <  s).  Let 
/  =  {1, . . . ,  2Ar} .  Note  that,  since  /  is  unsatisfiable,  so  is  /'.  If  a,;.,-  <  0  for  some 
i,j,  then,  by  Lemma  A.  13,  we  must  have  Sj  =  0.  Let  I"  =  {j  :  atj  <  0  for  some  i}\ 
let  I'  =  I  —  I" .  Let  P'  and  N'  be  the  result  of  setting  all  entries  in  column  j  of 
P  (resp.,  N)  to  0,  for  all  j  £  I" .  The  formula  /"  corresponding  to  the  matrices 
P'  and  N'  is  provably  equivalent  to  the  original  /',  by  IneqF:  since  Sj  =  0  for  all 
j  £  I",  it  must  be  the  case  that  aSj  —  0.  By  construction,  all  entries  in  P'  and  N ' 
are  nonnegative;  moreover,  N1  is  nonempty  (since  — >( — —  •  •  •  —  S2n  >  0)  is  in  f"). 

There  are  now  two  cases.  Taking  N'  =  ( 6'  ? ) ,  note  that  if  N'  has  a  row  i  with 
all  entries  nonnegative,  then  /"  provably  implies  that  — <(0<5i  +  •  •  •  +  0<52n  >  0).  But 
using  IneqF,  it  is  easy  to  show  that  0<5i  +  •  •  •  +  0<52.v  =  0.  This  shows  that  f", 
and  hence  f  and  /,  is  inconsistent.  On  the  other  hand,  if  all  the  rows  in  N'  have 
a  negative  entry,  then  the  formula  corresponding  to  P' ,  N'  is  in  fact  satisfiable. 
We  can  construct  a  structure  M  satisfying  /'  by  taking  M  =  ({J,;  :  i  £ 
where  n(Si)(p)  =  true  if  8,  =>  p  is  a  propositional  tautology.  This  contradicts  the 
assumption  that  f  is  unsatisfiable.  □ 

The  proof  of  Theorem  7.2  relies  on  the  following  small-model  result. 
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Lemma  A.  14.  Suppose  that  f  €  C\  is  satisfied  in  some  structure  in  A49 .  Then 
f  is  satisfied  in  a  structure  (W,tt)  where  \  W\  <  \f\,  and  t t(w)(j>)  =  false  for  every 
world  w  £  W  and  every  primitive  proposition  p  not  appearing  in  f. 

PROOF.  Suppose  that  f  £  C f  is  satisfied  in  a  structure  M  =  (W,  n).  conjunction 
of  gamble  inequalities  and  their  negations.  We  want  to  show  that  /  is  in  fact 
satisfied  in  a  small  structure.  As  usual,  we  can  assume  without  loss  of  generality 
that  /  is  a  conjunction  of  gamble  inequalities  and  their  negations. 

Suppose  that  there  are  r  gamble  inequalities  in  /  and  s  negations  of  gamble 
inequalities.  We  consider  two  cases.  If  s  =  0,  then  pick  any  w  £  W  and  let  M'  = 
(W',tt’),  with  W'  =  {w},  and  tt'  is  the  restriction  of  n  to  {u>}  (setting  7r (w)(p)  = 
false  for  every  primitive  proposition  p  not  appearing  in  /.  It  is  easy  to  check  that 
M'  |=  /,  since  w  £  W.  If  s  >  0,  then  for  every  negation  of  gamble  inequality 
-1(7  >  c)  appearing  in  /,  there  exists  a  world  w  £  W  such  that  Hy|}m(w)  <  c.  Let 
Wi , . . . ,  ws  be  such  worlds,  one  corresponding  to  each  of  the  s  negation  of  gamble 
inequalities  appearing  in  /.  Let  M'  =  (W ,  7r'),  where  W'  =  {uq, . . . ,  ws},  and  7 r'  is 
the  restriction  of  tt  to  W'  (setting  7 r'(w)(p)  =  false  for  primitive  propositions  p  not 
appearing  in  /).  Clearly,  every  gamble  inequality  in  /  is  satisfied  in  M' ,  since  W' 
is  a  subset  of  W.  Moreover,  by  choice  of  W' ,  every  negation  of  gamble  inequality 
in  /  is  also  satisfied  in  M'  (since  our  construction  guarantees  that  there  is  world 
in  M'  that  is  a  witness  to  the  falsity  of  all  the  negated  gamble  inequalities  in  /). 
Since  \W'\  =  s  <  |/|,  the  result  follows.  □ 

Theorem  7.2.  The  problem  of  deciding  whether  a  formula  of  C\  is  satisfiable 
in  Ai9  is  NP-complete. 

PROOF.  For  the  lower  bound,  observe  that  C\  includes  propositional  reasoning. 
Hence,  the  decision  problem  for  C\  is  at  least  as  hard  as  propositional  reasoning. 

For  the  upper  bound,  let  /  be  a  satisfiable  formula  of  C\.  We  first  guess  a 
small  model  M  =  (W,  tt)  for  the  formula,  of  the  form  guaranteed  to  exist  by 
Lemma  A. 14.  (As  usual,  the  fact  that  n(w)(p)  =  false  for  every  world  w  £  W 
and  every  primitive  proposition  p  not  appearing  in  /  means  that  we  must  describe 
tt  only  for  propositions  that  appear  in  /.)  We  verify  that  M  \=  f  inductively.  For 
basic  formulas  of  the  form  7  >  c,  we  must  check  that  for  all  w  £  W,  (w)  —  c- 
If  7  is  of  the  form  b\ +  •  •  •  +  bnpn,  then  we  can  compute  Hy[!-m(r;)  by  summing 
all  the  bi  such  that  pi  is  true  at  w  (i.e.,  n(w)(ipi)  =  true).  It  is  easy  to  see  that 
this  verification  can  all  be  done  in  time  polynomial  in  |/|  and  ||/||.  □ 

The  following  notation  is  useful  for  the  proofs  of  Theorem  7.3  and  Lemma  A.  18. 
Given  a  linear  inequality  formula  /  (over  real-valued  functions)  t  >  c,  we  write  / 
for  the  linear  inequality  formula  t  >  c  over  the  reals.  We  extend  this  to  Boolean 
combinations  of  linear  inequality  formulas  in  the  obvious  way. 

For  the  sake  of  our  proof  of  completeness  of  AX  ,  we  need  also  to  show  that  the 
following  formula  is  provable: 

0i>i  +  . . .  +  0vn  >  0  (13) 

This  formula  can  be  viewed  as  saying  that  the  right  implication  of  axiom  15  holds 
when  d  =  0. 

Lemma  A.  15.  The  formula  (13)  is  provable  from  A X-^ . 
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PROOF.  By  FI,  V\  >  v\,  that  is,  v-i  —  v\  >  0,  is  provable.  By  axiom  F3,  so 
is  —v\  +  Vi  >0.  If  we  add  these  latter  two  inequalities  by  F4,  and  delete  a  0 
term  by  F2,  we  obtain  Otq  >  0.  By  using  F2  to  add  0  terms,  it  follows  that 
Otq  +  . . .  +  Dvn  >  0  is  provable,  as  desired.  □ 

Theorem  7.3.  Axj  is  sound  and  complete  for  reasoning  about  formulas  about 
linear  inequalities  over  real-valued  functions  with  nonempty  domain. 

PROOF.  Soundness  is  straightforward.  For  completeness,  we  show  that  an  un- 
satisfiable  formula  /  is  inconsistent.  So  suppose  that  /  is  unsatisfiable.  As  usual, 
without  loss  of  generality,  we  can  assume  that  /  is  a  conjunction  of  inequalities 
and  their  negations,  say,  with  r  inequalities  and  s  negations  of  inequalities.  We 
prove  the  result  by  reducing  satisfiability  of  inequalities  over  real-valued  functions 
to  satisfiability  of  inequalities  over  real  numbers,  and  then  apply  techniques  from 
FHM. 

There  are  two  cases.  First,  suppose  that  s  =  0,  so  that  there  are  no  negations 
of  inequalities  in  /.  It  is  easy  to  see  that  since  /  is  unsatisfiable  over  functions,  / 
must  be  unsatisfiable  over  the  reals.  For  if  /  were  satisfiable  over  the  reals  with 
a  solution  x\, . . .  ,xk,  then  /  would  be  satisfied  by  taking  Xi  to  be  the  constant 
function  that  always  returns  x*. 

Write  /  in  matrix  form  as  Ax  >  b,  where  A  is  the  r  x  k  matrix  of  coefficients  on 
the  left-hand  side  of  the  inequalities,  x  is  the  column  vector  (x\, . . . ,  Xk),  and  b  is  the 
column  vector  of  the  right-hand  sides  of  the  inequalities.  Since  /  is  unsatisfiable, 
Ax  >  b  is  unsatisfiable.  As  in  FHM,  we  make  use  of  the  following  variant  of  Farkas’ 
lemma  [Farkas  1902]  (see  Schrijver  [1986,  page  89])  from  linear  programming. 

Lemma  A.  16.  If  Ax  >  b  is  unsatisfiable,  then  there  exists  a  row  vector  a  such 
that 

(1)  a  >  0; 

(2)  a  A  =  6; 

( 3 )  B-b>  0. 

Intuitively,  a  is  a  “witness”  or  “blatant  proof”  of  the  fact  that  Ax  >  b  is  un¬ 
satisfiable.  This  is  because  if  there  were  a  vector  x  satisfying  Ax  >  b ,  then 
0  =  (aA)x  =  a  (Ax)  >  ab  >  0,  a  contradiction. 

We  now  show  that  /  must  be  inconsistent.  Let  a  =  (<7i,...,oy)  be  the  row 
vector  guaranteed  to  exist  by  Lemma  A. 16.  Either  by  F5  or  by  Lemma  A. 15 
(depending  on  whether  <jj  >  0  or  a3  =  0),  we  can  multiply  both  sides  of  the  jth 
conjunct  of  /  by  <jj  (for  1  <  j  <  r),  and  then  use  F4  to  add  the  resulting  inequality 
formulas  together.  The  net  result  (after  deleting  some  0  terms  by  F2)  is  the  formula 
(Oiq  >  c),  where  c  =  a-b  >  0.  From  this  formula,  by  F6,  we  can  conclude  (Oiq  >  0), 
which  by  the  definition  of  >  implies  ->(0ui  <  0),  which  is  in  turn  an  abbreviation 
for  — >( — Owi  >  —0),  that  is,  — i(0vi  >  0).  Thus  /  =>  -i(0ui  >  0)  is  provable.  However, 
by  Lemma  A.  15,  (Ckq  >  0)  is  also  provable.  It  follows  by  propositional  reasoning 
that  -i/  is  provable,  that  is,  /  is  inconsistent,  as  required. 

Now  suppose  that  s  >  0.  Let  f+  be  the  conjunction  of  the  inequalities  in  /,  and 
let  gi, . .  .,gs  be  the  negations  of  inequalities  in  /.  That  is,  /  =  f+AgiA. .  .A  gs.  We 
first  show  that,  /+  A  g-i  must  be  unsatisfiable  over  the  reals  for  some  i  £  {1, . . . ,  s}. 
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Assume  by  way  of  contradiction  that  this  is  not  the  case,  that  is,  for  all  1  <  i  <  s, 
f+  A  fji  is  satisfiable  over  the  reals.  Let  x*  iy . . . ,  i  be  the  real  number  solution  to 
the  inequalities  f+  A  gt,  and  let  D  =  {di, . . . ,  ds}.  Define  the  functions  Ff , . . . ,  F£ 
over  D  by  taking  F*(di)  =  x*^.  It  is  easy  to  verify  that  /  =  f+  A  g\  A  . . .  A  gs  is 
satisfied  by  those  functions.  Intuitively,  for  every  element  di  of  the  domain,  f  +  is 
satisfied  by  Ff(di), . . . ,  Fj*(di),  so  that  f+  is  satisfied  by  F*, . . . ,  Fj*;  moreover,  each 
gi  is  also  satisfied,  since  by  the  choice  of  di,  we  have  a\Ff{df)  +  . . .  +  akF^(di)  <  c. 
Hence,  /  is  satisfiable  over  real-valued  functions,  a  contradiction.  Therefore,  /+ Ag,;0 
is  unsatisfiable  over  the  real  numbers  for  some  io-  As  in  the  case  s  =  0,  we  use  this 
fact  to  show  that  /  is  inconsistent. 

As  before,  we  can  write  f+  in  matrix  form  as  Ax  >  b.  Similarly,  the  formula 
cji0  =  -'(diaii  +  . . .  +  OfcXfc  >  c)  can  be  written  in  matrix  form  as  A'x  >  — c,  where 
A!  is  the  1  x  s  matrix  [— ai, . . . ,  —  a*,],  and  x  is  the  column  vector  (x\, . . . ,  Xk)-  Since 
f+  Affi0  unsatisfiable,  the  system  Ax  >  b ,  A'x  >  —  c  must  be  unsatisfiable.  Farkas’ 
lemma  does  not  apply,  but  a  variant  of  it,  called  Motzkin’s  transposition  theorem, 
which  is  due  to  Fourier  [1826],  Kuhn  [1956],  and  Motzkin  [1956]  (see  Schrijver  [1986, 
page  94]),  does. 

Lemma  A.  17.  If  the  system  Ax  >  b,A'x  >  — c  is  unsatisfiable,  then  there  exist 
a  row  vector  a  and  a  real  a'  such  that 


( 1 )  a  >  0  and  a'  >  0 ; 

(2)  a  A  +  a' A'  =  0; 

( 3 )  either 

(a)  o'  =  0  and  d  ■  b  >  0,  or 

(b)  a'  >  0  and  a  ■  b  —  a'c  >  0 

Since  Ax  >  b,  A'x  >  — c  is  unsatisfiable,  let  a  =  (or, . . . ,  ar)  and  a'  be  the  row 
vector  and  real  guaranteed  to  exist  by  Lemma  A.  17. 

If  case  3(a)  of  Lemma  A.  17  applies,  then  the  situation  is  identical  to  that  of 
Lemma  A.  16,  and  the  same  argument  shows  that  /  is  inconsistent.  If  case  (3b)  of 
Lemma  A.  17  applies,  then  a'  >  0.  As  before,  either  by  axiom  F5  or  by  Lemma  A.  15, 
we  can  multiply  both  sides  of  the  jth  conjunct  in  the  formula  f+  by  <Jj ,  for  1  <  j  <  r. 
This  results  in  the  following  system  of  inequalities: 


ciaipiq  +  •  •  •  +  aqai^u/j  >  <J\C\ 

oy V\  I  ■  ■  ■  I  <Xr(lr1k'Vk 


(14) 


Similarly,  by  F5,  we  can  multiply  both  sides  of  glu  by  a’  to  get  -<(<j'a\V\  + 
. .  .a'akvk  >  cr'c'). 

Let  a’[v i  +  •  •  •  +  a'fvk  >  d  be  the  result  of  “adding”  all  the  inequalities  in  (14). 
This  inequality  is  provable  from  /  using  F4.  Since  a  A  +  o'  A'  =  0,  and  A'  = 
[— ai, . . . ,  —  a*],  we  must  have  that  —o'aj  =  —a",  for  j  =  1  Thus,  gi0  => 

^(a”v i  +  •  •  •  +  a’fvk  >  cr'c')  is  provable.  Since  ob  —  o' c'  >  0,  it  follows  that  d  >  o'c' . 

Therefore,  by  F6,  a”v i  H - akvk  >  d  =>  a"v\  H - a’fvk  >  o'c!  is  provable.  Taking 

the  contrapositive,  we  get  that  g,;0  =4>  ->(a"u i  +  •  •  •  +  a'fvk  >  d)  is  provable.  But 
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f+  =>  a"i>i  +  •  •  •  +  a'l Vk  >  d  is  also  provable.  Since  /  =4-  /+  A  gi0  is  obviously 
provable,  it  follows  by  propositional  reasoning  that  -■/  is  provable,  that  is,  /  is 
inconsistent,  as  desired.  □ 

As  with  the  proof  of  NP-completeness  for  the  decision  problem  of  formulas 
about  linear  inequalities  (with  integer  coefficients)  over  real-valued  functions  with 
nonempty  domain  relies  on  the  following  small-model  result.  Here,  a  “small  model” 
for  a  formula  is  an  assignment  of  functions  with  a  small  domain.  This  can  be  done 
quickly,  as  we  shall  see. 

Lemma  A.  18.  Suppose  that  f  is  a  satisfiable  inequality  formula.  Then  f  has  a 
satisfying  assignment  where  there  are  at  most  \  f\  functions  in  the  assignment  with 
a  non- zero  range,  the  functions  in  the  assignment  have  a  domain  of  size  at  most 
If  I,  and  every  value  in  the  range  of  the  functions  is  a  rational  number  with  size 

0(1/111/11  + 1/|  iog(|/D). 

PROOF.  As  usual,  we  can  assume  without  loss  of  generality  that  /  is  a  conjunc¬ 
tion  of  inequality  formulas  and  their  negations.  Suppose  that  /  has  a  satisfying 
assignment  v(, . . . ,  vk,  over  a  domain  D.  Let  /+  be  the  conjunction  of  the  inequality 
formulas  in  r,  and  let  gi,...,gs  be  the  negations  of  inequality  formulas  in  /. 
Consider  two  cases,  depending  on  whether  s  =  0.  If  s  =  0,  pick  some  element 
d  of  D.  Clearly,  v*(d), . . . ,  vk(d)  is  a  solution  to  /,  and  thus  /  is  satisfiable  over  the 
reals.  By  Theorem  4.9  in  FHM,  /  is  satisfiable  with  a  solution  x\,...,x*k  where  at 
most  | /|  entries  are  nonzero,  and  each  nonzero  value  is  a  rational  number  of  size 
^(1/111/11  +  I/I  l°g( |/|) )-  From  this  solution,  we  can  construct  a  solution  Ff , . . .  ,F£ 
on  the  domain  D1  =  {d}  satisfying  the  conditions  of  the  theorem,  by  simply  taking 
1-7  id)  =  x*. 

Now  suppose  that  s  >  0.  Assume  /  is  satisfiable  over  functions,  with  a  solution 
Ff , ,  Ff  over  a  domain  D.  Clearly,  for  any  d  €  D,  F*(d),. . . ,  F£(d)  is  a  solution 
to  f+ .  For  any  1  <  i  <  s,  consider  gi  =  +  . . .  +  akVk  >  c).  There  must 

be  a  d  €  D  such  that  a\F((d)  +  . . .  +  akF^(d)  <  c.  Thus,  F((d), . ..  ,F£(d)  is  a 
solution  to  gi,  and  by  the  above  is  also  a  solution  to  f+.  Thus,  /+  A  g  is  satisfiable 
over  the  reals.  Again  by  Theorem  4.9  in  FHM,  we  have  a  solution  x\i,...,x^.i  of 

the  inequalities  /+  A  gi  such  that  at  most  |/|  entries  in  the  solution  are  nonzero, 
and  each  nonzero  value  is  of  size  0(|/|||/||  +  |/|  log(|/|)).  Let  D  =  {c?i, . . .  ,c4}. 
We  construct  a  solution  to  f+  A  g\  A  •  •  •  A  gs  from  those  solutions.  Define  the 
functions  F*,...,F over  D  such  that  F*(di)  =  £+.  it  is  easy  to  verify  that 
/  =  f+  A  g\  A  . . .  A  gs  is  satisfied  by  those  functions.  Intuitively,  for  every  element 
di  of  the  domain,  f+  is  satisfied  by  Ff(di),...,Ff(di)-,  moreover,  each  gi  (of  the 
form  ->(aiFi  +  . . .  +  akFk  >  c)  must  be  satisfied,  since  by  choice  of  di,  we  have 
a\Ff(di)  +  . . .  +  akF^(di)  <  c.  Clearly  this  assignment  Ff, . . .  ,F£  satisfies  the 
statement  of  the  lemma.  □ 

Theorem  7.4.  The  problem  of  deciding  whether  a  formula  about  linear  inequali¬ 
ties  (with  integer  coefficients)  is  satisfiable  over  real-valued  functions  with  nonempty 
domain  is  NP-complete. 

PROOF.  For  the  lower  bound,  note  that  we  can  reduce  propositional  satisfiability 
to  satisfiability  in  the  logic  of  linear  inequalities  by  simply  replacing  each  primitive 
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proposition  pi  in  a  propositional  formula  by  the  inequality  Vi  >  0. 

For  the  upper  bound,  let  /  be  a  satisfiable  inequality  formula.  We  guess  a  small 
satisfying  assignment  where  the  domain  D  of  the  functions  has  size  at  most  |/|; 
such  an  assignment  is  guaranteed  to  exist  if  /  is  satisfiable,  by  Lemma  A. 18.  It  is 
easy  to  verify  that  this  assignment  does  indeed  satisfy  f  in  time  polynomial  in  |/| 
and  ||/||.  □ 
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